163244 matches found
CVE-2026-37719
An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...
CVE-2026-88392
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
CVE-2026-88392
Unimall v4 is vulnerable to a Directory Traversal flaw located in the FileUploadController.local() component. This vulnerability allows an attacker to traverse the file system and potentially execute arbitrary code . While the root cause is identified as a failure to properly limit pathnames to a...
CVE-2026-78862: Missing Protection Mechanism for Alternate Hardware Interface
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board PCB...
CVE-2026-88392
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
CVE-2026-100102: Active Debug Code
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server...
CVE-2026-101919: Improper Input Validation
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...
CVE-2026-37719: Deserialization of Untrusted Data
An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...
CVE-2026-78861: Memory Allocation with Excessive Size Value
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...
CVE-2026-105677: Improper Limitation of a Pathname to a Restricted Directory
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0...
CVE-2026-104811: Unrestricted Upload of File with Dangerous Type
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...
CVE-2026-0482: Out-of-bounds Write
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This...
PT-2026-104774
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...
CVE-2026-19954
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips t...
CVE-2026-12171: Inclusion of Functionality from Untrusted Control Sphere
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
PT-2026-104752
Name of the Vulnerable Software and Affected Versions Perforce P4 Search versions prior to 2026.4.2 Description Container images reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can use this to obtain the highest...
Debian dsa-6544 : sabnzbdplus - security update
The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6544 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6544-1 [email protected] https://www.debian.org/security/ Moritz...
Debian dsa-6543 : fonts-opensymbol - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6543 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6543-1 [email protected] https://www.debian.org/securit...
