290767 matches found
PT-2026-104478
Name of the Vulnerable Software and Affected Versions Dell OpenManage Integration with Microsoft Windows Admin Center versions prior to 3.7.0 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A low privileged attacker with...
Unauthenticated Administrative REST API Access in Brocade ASCG before 3.5.0 (CVE-2026-85489)
An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...
CVE-2026-104613: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been public...
PT-2026-104329
A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been public...
The vulnerability of the graphical interface of the FortiMail email protection system allows a hacker to write arbitrary files.
The vulnerability of the FortiMail email protection systemās graphical interface is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files using specially crafted HTTP requests...
MAL-2026-17453 Malicious code in gocommunity.io/orderedbtree (Go)
Part of the Graphalgo campaign. The module, first published around 2026-08-11, contains a second-stage remote access trojan in plaintext that runs automatically. The RAT collects system information, executes decrypted Go or JavaScript payloads, and polls two command-and-control channels every 3-1...
CVE-2026-104614: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is public...
PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...
PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...
rubygem-hammer_cli: command injection via insecure editor invocation
A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...
rubygem-hammer_cli: command injection via insecure editor invocation
A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...
foreman: command injection in foreman-rake database tasks
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...
rubygem-hammer_cli: command injection via insecure editor invocation
A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...
Security Bulletin: IBM i is Affected by Algorithm Downgrade in Transport Layer Security [CVE-2026-4942]
Summary IBM i Transport Layer Security TLS is vulnerable to selection of less-secure algorithm during negotation CVE-2026-4942 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-4942 DESCRIPTION: IBM i could allow a remote attacker to send a specifically craft...
Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...
CVE-2026-102667
Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...
EUVD-2026-91031
A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps...
CVE-2026-93832
A Motorola system application component was exported without permission , creating a security flaw that allows for the revocation of runtime permissions from other applications. The vulnerability is associated with CWE-862 (Missing Authorization) . No specific affected versions or remediation ste...
CVE-2026-47492
A flaw was found in the NVIDIA GPU Display Driver. Due to improper access control in the kernel mode layer, an authenticated local attacker can exploit this vulnerability to cause a Denial of Service DoS, resulting in system instability or driver disruption...
CVE-2026-12545
A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...