272259 matches found
EUVD-2026-70801
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...
EUVD-2026-70813
MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSIONFILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntl...
EUVD-2026-70815
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...
EUVD-2026-70818
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
...[ More ]
Payara Server contains a vulnerability in its Server-Side Includes SSI implementation that allows arbitrary operating system command execution via the exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec without validation, sanitization, or...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106456)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106456 advisory. GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...
PT-2026-86223
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...
EUVD-2026-71608
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...
CVE-2026-75429
PowerJob (distributed job scheduling/computing framework) versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint on the Worker↔Server transport-layer HTTP port 10010 . The endpoint reflects arbitrary public methods of arbitrary Sp...
The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-71620
CVE-2026-71620 is a file upload vulnerability in Zhao-github ApiAdmin v5.0.1 that allows a remote attacker with low privileges to execute arbitrary code by uploading a crafted .php file. The CVSS 3.1 score is 8.1 (HIGH) , reflecting network reachability, low attack complexity, and high impact on ...
CVE-2026-78745
An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...
CVE-2026-31020
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...
EUVD-2025-210847
SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...
EUVD-2026-71612
PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...
EUVD-2026-71610
Cross Site Scripting vulnerability in Netgate pfSense Plus software versions = 26.03 pfSense CE software versions = 2.8.1 allows a remote attacker to execute arbitrary code via the captiveportalstatus.widget.php file...
Flextype CMS 1.0.0-alpha.3 Remote Code Execution
Flextype CMS version 1.0.0-alpha.3 contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes. The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content...
MiracleLinux 8 : gimp:2.8 (AXSA:2026-1773:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1773:01 advisory. gimp: gimp: Stack buffer overflow in pnmscannergettoken CVE-2026-58380 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflo...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-base (UTSA-2026-106461)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106461 advisory. GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...