272919 matches found
Flextype CMS 1.0.0-alpha.3 Remote Code Execution
Flextype CMS version 1.0.0-alpha.3 contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes. The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content...
PT-2026-86223
An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...
CVE-2026-31020
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...
CVE-2026-71620
CVE-2026-71620 is a file upload vulnerability in Zhao-github ApiAdmin v5.0.1 , classified by Rapid7 as an Unrestricted Upload of File with Dangerous Type . A remote attacker can upload a crafted .php file to achieve arbitrary code execution (RCE). CISA's SSVC assessment rates exploitation as none...
CVE-2026-75429
PowerJob versions 4.x through 5.1.2 expose the /friend/process endpoint on the Server-Worker transport layer (HTTP port 10010) without any authentication. An attacker can invoke an arbitrary public method on any Spring Bean; specifically, calling GroovyEvaluator.evaluate allows execution of arbit...
The vulnerability of the “magnify” operation in the console-based image editing tool ImageMagick allows a hacker to execute arbitrary code.
The vulnerability of the “magnify” operation in the console-based image editing tool ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system allows a hacker to execute arbitrary code.
The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-base (UTSA-2026-106461)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106461 advisory. GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...
CVE-2026-75429
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...
EUVD-2026-71453
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...
CVE-2026-79423
An authenticated remote code execution vulnerability in the admin_config.php component of seacms v13.6 allows an attacker with low privileges to execute arbitrary code via a crafted POST request. The CVSS 3.1 score is 8.8 (HIGH) with high impact on confidentiality, integrity, and availability. CI...
CVE-2026-31020
CVE-2026-31020 affects DocsGPT 0.15.0 and below , where the application's custom prompt feature renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. This enables an unauthenticated attacker to inject malicious template expressions, resulting in a serve...
CVE-2026-75431
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
PT-2026-86247
CVE-2026-50894: Unrestricted file upload in easyadmin v2.0.2.2 enables authenticated RCE and full server takeover. CVSS not scored, but impact is critical. If you use easyadmin, restrict access and audit uploads now. Patch https://t.co/GZLmhBXY4r cybersecurit valtersit CVE CVEAlert infosec SysAdm...
CVE-2026-78745
CVE-2026-78745 affects HiDPT / Weyon HiDPTAndroid devices running the Hi3751V350 and Hi3751V352E_DMO platforms. The Android Debug Bridge daemon (adbd) is exposed to remote access without expected privilege restrictions, and ADB sessions execute with root-level permissions , enabling arbitrary cod...
CVE-2026-71624
An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components...
CVE-2026-71624
esoTalk v1.0.0g4 is vulnerable to remote code execution via a Configuration Comment Injection flaw, as indicated by the advisory reference. The attack targets the ETMemberModel.class.php, ETMemberController.class.php, and ET.class.php components, requiring no authentication or user interaction . ...
The vulnerability of the PDB decoder in the console-based ImageMagick graphics editor allows a hacker to execute arbitrary code.
The vulnerability of the PDB console-based ImageMagick graphics editor relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
CVE-2026-75430
PowerJob Worker version 5.1.2 (and likely earlier) exposes the /worker/deployContainer HTTP endpoint without authentication on its default transport port, allowing a remote unauthenticated attacker to execute arbitrary code . The vulnerability is scored CVSS 9.8 (Critical) — network attack vector...
