CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-61980

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-61962

Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...

CVE-2026-27544

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

EUVD-2026-57939

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27544 WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27544

CVE-2026-27544 affects the WordPress QA Analytics plugin (versions ≤ 5.2.0.0). It enables unauthenticated Remote Code Execution via a flaw described in multiple sources. The provided documents do not specify the root cause, affected component details beyond the plugin/version, or a confirmed reme...

Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Summary IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server component spanning three...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

ALPINE-CVE-2026-16239

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14662

The CVE-2026-14662 entry describes an integer wraparound in PostgreSQL tsvector/tsquery data type functions, allowing an unprivileged database user to cause undersized allocations and out-of-bounds writes via crafted inputs. Consequences stated include potential arbitrary code execution as the op...

MAL-2026-13996 Malicious code in @nolimit-agent/linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13997 Malicious code in @nolimit-agent/win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4e440b5c1a499bb904b604509fd09284195641769bcea441044c9b15720106 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

EUVD-2026-57830

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

DEBIAN-CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-73601

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...

UBUNTU-CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

UBUNTU-CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create and Submodule.add URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into...