CVE-2026-67926

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module...

CVE-2026-67965

Tenda W20E V5.0 firmware US_W20EV5.0qu_V16.01.0.6(2782)_CN&EN_TDE01.bin exposes url_need_login to bypass authentication when the admin password is empty (factory default), enabling unauthenticated activation of /goform/ate — an AES-128-CBC backdoor on UDP/7329 using hardcoded key Tenda0123456789M...

EUVD-2026-60448

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...

The vulnerability of the Jolokia component in Apache ActiveMQ allows a hacker to execute arbitrary code.

The vulnerability of the Jolokia component in Apache ActiveMQ is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-67960

PbootCMS v.3.2.15 is vulnerable to arbitrary code execution through multiple components: MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php. The vulnerability is exploitable over the network with low complexity , no privileges required , and no ...

EUVD-2026-60351

A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly...

EUVD-2026-60446

Buffer Overflow vulnerability in SteelSeries GG macOS v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dupwcs components...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-50772

Squirro Cognitive Search versions below 3.14.2 contain a flaw in the password reset function allowing unauthenticated remote attackers to execute arbitrary code, rated CVSS 9.8 Critical. A proof-of-concept exploit is available at https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50772; up...

CVE-2026-50773

CGM ISIS MED (CompuGroup Medical, Germany) version 2510.1.0.20 is vulnerable to arbitrary code execution via a crafted .dll file . The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector requiring user interaction but no privileges. CISA's SSVC assessment rates exploitation as poc (proof-of-c...

EUVD-2026-60444

An issue in Tneda W20E v.16.01.0.62782 allows a remote attacker to execute arbitrary code via the urlneedlogin function...

PT-2026-76744

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

PT-2026-76687

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /new run endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able...

EUVD-2026-60354

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

PT-2026-76864

Name of the Vulnerable Software and Affected Versions Qcms version 6.0.6 Description An SQL Injection issue allows a remote attacker to execute arbitrary code. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthoriz...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-67960

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components...

CVE-2026-67678

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

CVE-2026-50775

A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly...

PT-2026-76653

Name of the Vulnerable Software and Affected Versions In Progress ShareFile Storage Zones Controller versions prior to 5.12.6 In Progress ShareFile Storage Zones Controller versions prior to 6.0.3 Description An authenticated zone administrator can exploit improper validation within the download...