RethinkDB security vulnerabilities

RethinkDB is an open-source database developed by RethinkDB. RethinkDB versions 2.4.4 and earlier have a security vulnerability. This vulnerability stems from a buffer overflow in the JSON parsing component cJSON.Cc, which could allow for the execution of arbitrary code...

📄 PLY 3.11 Arbitrary Code Execution

An undocumented and unsafe feature in the PyPI‑distributed version of PLY version 3.11 allows arbitrary code execution when the yacc function is invoked with the picklefile parameter. 🚨 Undocumented Remote Code Execution in PLY CVE‑2025‑56005 CVE ID: CVE‑2025‑56005 Reported by: Ahmed Abd Disclosu...

Motorola Device Manager code-related vulnerabilities

Motorola Device Manager is a computer-based device management tool developed by the American company Motorola. Version 2.5.4 of Motorola Device Manager contains a code vulnerability caused by an unquoted service path, which may allow for the execution of arbitrary code...

KLA90860 ACE vulnerability in Mozilla Thunderbird ESR

A remote code execution vulnerability was found in Mozilla Thunderbird ESR. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories MFSA2026-08 Related products Mozilla-Thunderbird-ESR CVE list CVE-2026-0818 unknown Solution Update to the latest version...

Quick-Media security vulnerabilities

Quick-Media is a multimedia service software developed by YiHui’s individual developers. Versions of Quick-Media prior to v1.0 contained security vulnerabilities. These vulnerabilities stemmed from a code injection vulnerability in the PNG encoding component, PNGImageEncoder.Java, which could all...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Git LFS vulnerabilities (USN-7977-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7977-1 advisory. Ryota K discovered that Git LFS may leak login credentials in certain instances due to failing to check for...

PT-2026-4999

Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:Program Files x86AcerRegistration to inject malicious executables that...

xrdp security vulnerabilities

XRDPT is an open-source remote desktop protocol server developed by Neutrinolabs. Versions of XRDPT prior to v0.10.5 contained security vulnerabilities. These vulnerabilities stemmed from improper boundary checking when processing user domain information, which could lead to stack-based buffer...

EZCast Pro II security vulnerabilities

EZCast Pro II is a computer screen-sharing software developed by EZCast Corporation in China. This software allows for wireless sharing of data from computer devices onto televisions or projection screens. EZCast Pro supports screen allocation and projection permissions. Version 1.17478.146 of...

Motorola Device Manager code-related vulnerabilities

Motorola Device Manager is a computer-based device management tool developed by the American company Motorola. Version 2.4.5 of Motorola Device Manager contains a code vulnerability caused by an unquoted service path, which may allow for the execution of arbitrary code...

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation

A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform...

Delta Electronics ASDA-Soft 安全漏洞

Delta Electronics ASDA-Soft is an AC servo motor from Delta Electronics China. The Delta Electronics ASDA-Soft suffers from a stack buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

vm2 has a Sandbox Escape

In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. js const VM = require"vm2"; const code = const error = new Error; error.name = Symbol; const f = async = error.stack...

GHSA-99P7-6V5W-7XG8 vm2 has a Sandbox Escape

In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. js const VM = require"vm2"; const code = const error = new Error; error.name = Symbol; const f = async = error.stack...

CVE-2025-71178 Crucial Storage Executive < 11.08.082025.00 Installer DLL Preloading LPE

Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elevated privileges and loads Windows DLLs using an uncontrolled search path, which can cause a malicious DLL placed alongside the installer t...

CVE-2025-71178

CVE-2025-71178 affects Crucial Storage Executive installer versions

CVE-2020-36959 IDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service Path

IDT PC Audio 1.0.6499.0 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the STacSV service to inject malicious code that would execute with LocalSystem account...

CVE-2020-36953 MiniTool ShadowMaker 3.2 - 'MTAgentService' Unquoted Service Path

MiniTool ShadowMaker 3.2 contains an unquoted service path vulnerability in the MTAgentService that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\MiniTool ShadowMaker\AgentService.exe' to inject malicious executables and...

GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write

A flaw was found in GnuPG. An attacker can provide crafted input to the armorfilter function, which incorrectly increments an index variable, leading to an out-of-bounds write. This memory corruption vulnerability may allow for information disclosure and could potentially lead to arbitrary code...

CVE-2026-0775

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...