dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection

A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection SSTI vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template...

foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

[SECURITY] [DLA 4811-1] chromium security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4811-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 02, 2026 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 4810-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4810-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 02, 2026 https://wiki.debian.org/LTS -...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

DEBIAN-CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-0848

CVE-2026-0848 — NLTK StanfordSegmenter: 신뢰할 수 없는 JAR 로딩을 통한 임의 코드 실행 -red?style=for-the-badge -brightgreen?style=for-the-badge 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2026-0848 패키지| nltk Natural Language Toolkit 레지스트리| PyPI 영향받는 버전| = 3.9.2 취약점 유형| CWE-20: 부적절한 입력 검증 CVSS 점수| 10.0 Critical 공격 경로| 네트워크 공...

EUVD-2026-91054

Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-103484 pgvector buffer overflow in IVFFlat index build

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-103484

A flaw in pgvector before version 0.8.7 allows an authenticated database user to trigger an out-of-bounds write during an Inverted File Flat (IVFFlat) index build operation. This vulnerability can lead to arbitrary code execution or a crash resulting in a denial of service on the database server....

EUVD-2026-91044

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

obsidian-note-toolbar-PoC

Note ToolbarにおけるpropNAME → js:変数チェーンを介したFrontmatter駆動の任意コード実行 CVEステータス: 申請済み、割り当て待ち。この脆弱性は GHSA-q8cw-3m8c-5pf2として公開されています。CVEが割り当てられた時点で、このリポジトリは CVE-YYYY-NNNNN-obsidian-note-toolbar-PoCに改名され、このバナーはCVEリンクに置き換えられます。 | ---|--- 研究者| Dostxodjayev Abdullox @squeeze440 アドバイザリ| GHSA-q8cw-3m8c-5pf2 CVSS...

CVE-2026-0303

Checkov 任意コード実行 CVE-2026-0303 CVE: CVE-2026-0303 | CVSS 基本値: 6.3 | 深刻度: 低 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H CVE-2026-0303 - Checkov における任意コード実行の脆弱性。 2026年9月9日に Palo Alto Networks により公開。 影響を受けるバージョン: Checkov 3.2.0 から 3.2.531 修正バージョン: Checkov 3.2.532 TLDR 自動読み込みされる...

CVE-2026-8618

A stack-based buffer overflow vulnerability exists in the TDDPv2 service /usr/bin/tddp on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent,...

CVE-2026-7669-PoC

CVE-2026-7669 SGLangは、transformers v5がTokenizersBackendオブジェクトを返すたびに、trustremotecode=Falseを黙ってTrueに上書きし、AutoTokenizer.frompretrainedを再呼び出しします。カスタムtokenizerclassとtokenizer.pyを指すautomapを持つモデルは、オペレーターがFalseを渡した場合でも、SGLangプロセス内で任意のコード実行に到達します。どのログレベルでもログ行は出力されません。 プロジェクト:...

Pluck-CMS-Stored-XSS---Installation

Pluck CMS 4.7.18 저장형 XSS 작성자: Sergio 설명: PluckCMS v.4.7.18 설치 과정에서 발견된 다중 교차 사이트 스크립팅XSS 취약점으로, 로컬 공격자가 설치 과정의 웹사이트 이름Website Name에 해당하는 cont1 및 cont2 파라미터에 주입된 조작된 페이로드를 통해 임의 코드를 실행할 수 있게 합니다. 공격 벡터: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L POC: 설치 과정에서 두 파라미터 중 하나에 XSS 페이로드를 입력하고, 다음next을 클릭하면 XSS...

CVE-2024-44346

CVE 공개: CVE-2024-44346 날짜: 2024년 9월 13일 요약 Tosibox tbsetup.exe 버전 4.0.0.0에서 로컬 권한 상승을 허용할 수 있는 취약점이 확인되었습니다. 이 문제에는 CVE-2024-44346 식별자가 할당되었습니다. 공급업체는 추가 세부 정보와 해결 단계가 포함된 권고를 발표했습니다. 영향을 받는 제품 공급업체 : Tosibox 제품 : tbsetup.exe 버전 : 4.0.0.0 취약점 설명 Tosibox는 Tosibox Key 설치 프로그램tbsetup.exe을 실행할 때 임의 코...