EUVD-2026-75761

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

EUVD-2026-75769

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-75799

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

CVE-2026-87986: Improper Handling of Syntactically Invalid Structure

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

Ivanti Neurons for ITSM has a missing authorization vulnerability (CNVD-2026-37875)

Ivanti Neurons for ITSM is a modern IT Service Management ITSM software developed by Ivanti Corporation. Ivanti Neurons for ITSM has a missing authorization vulnerability. This vulnerability stems from defects in authorization verification, resulting in incorrect user permission validation...

CVE-2026-48490: Buffer Copy without Checking Size of Input

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino Stri...

CVE-2026-87985: Incomplete List of Disallowed Inputs

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2026-80469: Improper Verification of Cryptographic Signature

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required...

Ivanti Neurons for ITSM deserialization vulnerability

Ivanti Neurons for ITSM is a suite of enterprise-level IT service management ITSM software developed by Ivanti Corporation. Ivanti Neurons for ITSM has a deserialization vulnerability, which stems from improper handling of deserialized data that is not trusted. Attackers can exploit this...

PT-2026-89888

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

PT-2026-89889

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions prior to 2.25.4-1.1 Description An arbitrary code execution issue exists where an attacker can bypass command permission checks. This is achieved by using environment variable assignments before allowlisted commands, as...

Ivanti Neurons for ITSM deserialization vulnerability (CNVD-2026-37870)

Ivanti Neurons for ITSM is a modern IT Service Management ITSM software developed by Ivanti Corporation. Ivanti Neurons for ITSM has a deserialization vulnerability. This vulnerability arises from improper validation of deserialized data that is not trusted. Attackers can exploit this vulnerabili...

Ivanti Neurons for ITSM deserialization vulnerability (CNVD-2026-37871)

Ivanti Neurons for ITSM is a modern IT Service Management ITSM software developed by Ivanti Corporation. Ivanti Neurons for ITSM has a deserialization vulnerability. This vulnerability arises from improper handling of deserialized data that is not trusted. Attackers can exploit this vulnerability...

Ivanti Neurons for ITSM has a missing authorization vulnerability

Ivanti Neurons for ITSM is a modern IT Service Management ITSM software developed by Ivanti Corporation. Ivanti Neurons for ITSM has a missing authorization vulnerability; this vulnerability arises from incorrect user authorization verification. Attackers can exploit this vulnerability to execute...

ROS-20260911-73-0073

The vulnerability in Chromium is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-90512

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A file-transfer interface requiring valid credentials fails to restrict shell metacharacters in uploaded filenames. An automated process subsequently uses these...

PT-2026-89887

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

RockyLinux 9 : nginx (RLSA-2026:66542)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66542 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLinu...

CVE-2026-87987: External Control of System or Configuration Setting

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

PT-2026-89809

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required...