CVE-2026-66065

CVE-2026-66065 affects Ouroboros, a local-first runtime for AI coding agents. Before 0.42.1, the denylist was incomplete: multiple execution-routing keys of the same RCE class were omitted, allowing a malicious cloned repo to trigger arbitrary command execution via a .env loaded at import. The pr...

CVE-2026-66065 Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...

CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-47211 Ouroboros: Remote Code Execution via Untrusted Project-Directory .env

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, if a user clones a malicious repository and runs Ouroboros commands within that directory, it can lead to arbitrary code executi...

CVE-2026-18632

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066

Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...

CVE-2026-61524

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

CVE-2026-61523

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

Security Bulletin: IBM QRadar SIEM is vulnerable to remote code execution by privileged users

Summary An authenticated QRadar SIEM administrator can execute arbitrary commands on the QRadar host due to improper validation of user supplied input. Vulnerability Details CVEID:CVE-2026-13477 DESCRIPTION: QRadar could allow an authenticated privileged user to execute arbitrary commands with...

EUVD-2026-52397

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

EUVD-2026-52394

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

CVE-2026-61524 WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

CVE-2026-61524 WebsiteBaker CMS < 2.13.10 File Upload RCE via Module Installation

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

CVE-2026-61524

CVE-2026-61524 affects WebsiteBaker CMS prior to version 2.13.10. An unrestricted file upload in the module installation feature lets authenticated administrators upload a crafted ZIP containing a PHP webshell and a valid info.php metadata file. The archive is extracted to a web-accessible module...

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

EUVD-2026-52393

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

Rapid7 Analysis: KindaRails2Shell (CVE-2026-66066)

Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, an arbitrary file read in Active Storage applications that use the Vips image processor with untrusted uploads. The affected Active Storage ranges are = 8.0, = 8.1, 8.1.3.1. Vips is the default...

CVE-2026-67326

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...