15859 matches found
EUVD-2026-2445
An insecure authentication mechanism in the safeexec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to the device to execute arbitrary commands with root privileges, if file /opt/images/publickey.der is not present in the file...
MiracleLinux 3 : sudo-1.6.9p17-3AXS3.1 (AXSA:2009-35:01)
The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2009-35:01 advisory. Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all...
CVE-2022-50927
Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin group. Attackers can exploit the default user configuration to gain root access by manipulating system binaries and leveraging unrestricte...
CVE-2025-7072
The firmware in KAON CG3000TC and CG3000T routers contains hard-coded credentials in clear text shared across all routers of this model that an unauthenticated remote attacker could use to execute commands with root privileges. This vulnerability has been fixed in firmware version: 1.00.67 for...
CVE-2021-47751
CVE-2021-47751 affects CuteEditor for PHP (Rich Text Editor) version 6.6. The vulnerability is a directory traversal in the browse template feature that enables writing files to arbitrary web root directories by abusing ServerMapPath() to rename uploaded HTML files with traversal sequences, outsi...
CVE-2025-37186
CVE-2025-37186 is a local privilege-escalation vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client. The Red Hat, NVD, CVE List and other feeds describe an ability for a local attacker to achieve arbitrary code execution with root privileges, via a local attack vector (n...
CVE-2025-37169
A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated malicious actor to execute arbitrary code as a privileged user on the underlying operating system...
Multiple vulnerabilities in EATON UPS Companion
Overview EATON UPS Companion provided by Eaton contains multiple vulnerabilities listed below. Uncontrolled search path element CWE-427, CVE-2025-59887 Unquoted search path or element CWE-428, CVE-2025-59888 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported these vulnerabilities to th...
CVE-2022-50927: Incorrect Privilege Assignment
Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin group. Attackers can exploit the default user configuration to gain root access by manipulating system binaries and leveraging unrestricte...
PT-2026-2403
Name of the Vulnerable Software and Affected Versions Cyclades Serial Console Server version 3.3.0 Description The Cyclades Serial Console Server has a local privilege escalation issue. The problem stems from overly permissive sudo privileges granted to the admin user and admin group. An attacker...
IBM DB2 Privilege Escalation (7250486) (Unix)
According to its self-reported version number, IBM Db2 on Unix may be affected by a vulnerability: - IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows includes Db2 Connect Server under specific configurations could allow a local user to execute malicious code that escalate their privilege...
EUVD-2026-2008
LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fix...
CVE-2026-22252 LibreChat MCP Stdio Remote Command Execution
LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fix...
CVE-2026-22252 LibreChat MCP Stdio Remote Command Execution
LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fix...
CVE-2026-22252 LibreChat MCP Stdio Remote Command Execution
LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fix...
Logstash Data Collection System Code Execution
The vulnerability of the Logstash data collection system, a software monitoring and logging analysis tool for Nagios Log Servers, is related to errors in privilege management. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code with root privileges and...
CVE-2025-55125
This vulnerability allows a Backup or Tape Operator to perform remote code execution RCE as root by creating a malicious backup configuration file...
CVE-2025-59469
This vulnerability allows a Backup or Tape Operator to write files as root...
PT-2026-2183
Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.2-rc2 Description LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.2-rc2, the MCP stdio transport does not validate commands, allowing authenticated users to execute shell commands as...