EUVD-2026-71611

An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...

OpenCode Unauthenticated Remote Code Execution

OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability that can allow a remote attacker to obtain a session identifier and execute arbitrary commands through the session shell endpoint. This proof of concept retrieves an available session and demonstrate...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: redis (UTSA-2026-106458)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106458 advisory. Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK...

CVE-2026-75431

PowerJob Server version 5.1.2 (and likely earlier) suffers from a predictable JWT signing key used for HS256-based authentication, allowing a remote attacker with no prior access to forge valid tokens and execute arbitrary code . The vulnerability is rated CVSS 9.1 (Critical) with high confidenti...

Linux Distros Unpatched Vulnerability : CVE-2026-76174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based o...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-85439

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-85437

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack...

CVE-2026-85427

MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSIONFILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntl...

CVE-2026-85425

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

CVE-2026-18167

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...

gitpython: GitPython: Remote Code Execution via malicious Git template

A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...

gitpython: GitPython: Remote Code Execution via kwarg value smuggling

A flaw was found in GitPython. Attackers can bypass the checkunsafeoptions guard by smuggling git options within single-character keyword argument kwarg values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as clonefrom or fetch, leading to...

gitpython: GitPython: Remote Code Execution via malicious Git hooks

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...

CVE-2026-85439

MOOS-IvP through 24.8.1 contains a command injection vulnerability in alogsplit 's SplitHandler::handlePreCheckSplitDir() function, which fails to sanitize shell metacharacters in log file pathnames. An attacker can embed shell syntax in log file names or the --dir parameter to execute arbitrary ...

CVE-2026-85439 MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-85439 MOOS-IvP through 24.8.1 alogsplit Command Injection via Input Pathname

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...

CVE-2026-85437

MOOS-IvP through version 24.8.1 is affected by multiple buffer overflow vulnerabilities in its IvP function string decoders (specifically in FunctionEncoder.cpp). The root cause is that decoders trust attacker-controlled length fields without validation, allowing an attacker to craft malicious en...

CVE-2026-85437 MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack...

CVE-2026-85437 MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack...