167644 matches found
CVE-2026-52484: Improper Neutralization of Special Elements used in an OS Command
An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...
RockyLinux 9 : postgresql:16 (RLSA-2026:67491)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67491 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitra...
PT-2026-92170
An issue in MitraStar GPT-2742GX4X5v6-SV GL g2.5 100XNT0b23 3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...
CVE-2026-91748: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...
CVE-2026-91735: Incorrect Authorization
Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-91734: Incorrect Authorization
Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...
CVE-2026-91715: Access of Resource Using Incompatible Type
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-76694: Improper Privilege Management
A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to escalate privileges beyond their authorized level, and execute arbitrary code on a...
CVE-2026-76682: Buffer Copy without Checking Size of Input
A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or potentially execute arbitrary code on th...
CVE-2026-61668: Improper Certificate Validation
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl.createunverifiedcontext to download the second-stage pilot.tar archive without TLS certificat...
CVE-2026-12354: Improper Control of Dynamically-Managed Code Resources
IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to...
EUVD-2026-78814
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...
PT-2026-95727
Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp versions 1.0 through 1.52.4 Description A privilege escalation issue exists that allows local users with permission to create VPN connections to execute arbitrary code as root. An attacker can inject pppd options by using a...
AlmaLinux 10 : nginx (ALSA-2026:67314)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...
KLA91323 Multiple vulnerabilities in Oracle VirtualBox
Multiple vulnerabilities were found in Oracle VirtualBox. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Memory safety vulnerability can be exploit...
Important: Red Hat Security Advisory: ansible-core security update
An update for ansible-core is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...
Malicious code in get-power (npm)
Source: amazon-inspector e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7 get-power impersonates ljharb's get-proto utility package.json declares author 'Jordan Harband ' and homepage github.com/ljharb/get-power while mirroring get-proto's file layout as cover. On require, index.j...
CVE-2026-12944
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...
CVE-2026-65414
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected app...