foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

[SECURITY] [DLA 4811-1] chromium security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4811-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 02, 2026 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 4810-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4810-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 02, 2026 https://wiki.debian.org/LTS -...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

DEBIAN-CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-0848

CVE-2026-0848 — NLTK StanfordSegmenter: Arbitrary Code Execution via Untrusted JAR Loading -red?style=for-the-badge -brightgreen?style=for-the-badge Overview Field| Details ---|--- CVE ID| CVE-2026-0848 Package| nltk Natural Language Toolkit Registry| PyPI Affected Versions| = 3.9.2 Vulnerability...

EUVD-2026-91054

Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...

CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...

CVE-2026-103484 pgvector buffer overflow in IVFFlat index build

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-103484

A flaw in pgvector before version 0.8.7 allows an authenticated database user to trigger an out-of-bounds write during an Inverted File Flat (IVFFlat) index build operation. This vulnerability can lead to arbitrary code execution or a crash resulting in a denial of service on the database server....

CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

EUVD-2026-91044

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

obsidian-note-toolbar-PoC

propNAME → js: 변수 체인을 통한 Note Toolbar의 Frontmatter 기반 임의 코드 실행 CVE 상태: 요청됨, 할당 대기 중. 이 발견은 GHSA-q8cw-3m8c-5pf2로 공개되었습니다. CVE가 할당되면 이 저장소는 CVE-YYYY-NNNNN-obsidian-note-toolbar-PoC로 이름이 변경되고 이 배너는 CVE 링크로 대체됩니다. | ---|--- 연구자| Dostxodjayev Abdullox @squeeze440 권고| GHSA-q8cw-3m8c-5pf2 CVSS 3.1| 7.0...

CVE-2026-0303

Checkov 임의 코드 실행 CVE-2026-0303 CVE: CVE-2026-0303 | CVSS 기본 점수: 6.3 | 심각도: 낮음 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H CVE-2026-0303 - Checkov의 임의 코드 실행 취약점. 2026년 9월 9일 Palo Alto Networks에 의해 공개됨. 영향받는 버전: Checkov 3.2.0 3.2.531 수정된 버전: Checkov 3.2.532 TLDR 자동 로드되는...

CVE-2026-8618

A stack-based buffer overflow vulnerability exists in the TDDPv2 service /usr/bin/tddp on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent,...

CVE-2026-7669-PoC

CVE-2026-7669 SGLang은 trustremotecode=False를 조용히 True로 덮어쓰고, transformers v5가 TokenizersBackend 객체를 반환할 때마다 AutoTokenizer.frompretrained를 다시 호출합니다. 사용자 정의 tokenizerclass와 tokenizer.py를 가리키는 automap을 가진 모델은 운영자가 False를 전달했더라도 SGLang 프로세스 내부에서 임의 코드 실행에 도달합니다. 어떤 로그 레벨에서도 로그 줄이 출력되지 않습니다. 프로젝트:...

Pluck-CMS-Stored-XSS---Installation

Pluck CMS 4.7.18 저장형 XSS 작성자: Sergio 설명: PluckCMS v.4.7.18 설치 과정에서 발견된 다중 교차 사이트 스크립팅XSS 취약점으로, 로컬 공격자가 설치 과정의 웹사이트 이름Website Name에 해당하는 cont1 및 cont2 파라미터에 주입된 조작된 페이로드를 통해 임의 코드를 실행할 수 있게 합니다. 공격 벡터: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L POC: 설치 과정에서 두 파라미터 중 하나에 XSS 페이로드를 입력하고, 다음next을 클릭하면 XSS...

CVE-2024-44346

CVE Disclosure: CVE-2024-44346 Date: 13-09-2024 Summary A vulnerability was identified in Tosibox tbsetup.exe version 4.0.0.0 , which could allow local privilege escalation . This issue has been assigned the identifier CVE-2024-44346 .The vendor has released an advisory with further details and...

[SECURITY] [DSA 6536-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6536-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 01, 2026 https://www.debian.org/security/faq -...