CVE-2025-44089

CVE-2025-44089 affects NCH Software ExpressZip v11.29. An arbitrary code execution vulnerability exists when a user downloads and executes a crafted archive file, as described in multiple sources. The issue is rated HIGH (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a network attack vecto...

CVE-2025-50330

Vulnerability detail: ZipGenius Team ZipGenius

CVE-2025-44090

An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

CVE-2025-44089

An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

PT-2026-63487

Name of the Vulnerable Software and Affected Versions NCH Software ExpressZip version 11.29 Description An issue allows attackers to execute arbitrary code when a user downloads and executes a specially crafted archive file. Recommendations At the moment, there is no information about a newer...

CVE-2025-44090

CVE-2025-44090 affects OhSoft CoffeeZip v4.8.0.0. A crafted archive file, downloaded and executed by a user, allows arbitrary code execution. The CVSSv3.1 base score is 8.8 (HIGH) with network attack vector, no privileges required, but user interaction is required. Impacts on confidentiality, int...

PT-2026-63440

Name of the Vulnerable Software and Affected Versions Duplicati version 2.3.0.1 Description Incorrect permission assignments allow authenticated users to have MODIFY permissions that propagate to all subdirectories. When the software is installed outside the default Program Files directory or on ...

PT-2026-63363

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly...

PT-2026-63491

Name of the Vulnerable Software and Affected Versions Franco Corbelli ZPAQFRANZ versions prior to 61.4 Description A flaw allows a remote attacker to escalate privileges and execute arbitrary code by bypassing the Mark-of-the-Web protection mechanism. Mark-of-the-Web is a security feature used by...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the unci tile decoding process. An attacker can achieve arbitrary code execution by supplying a specially crafted HEIF file that triggers a heap out-of-bounds write, allowing the overwrite of a C++ vtable pointer...

EUVD-2026-46418

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

CVE-2026-8987 Authenticated Heap Overflow

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the setapparam command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution...

CVE-2026-30631

An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 2025-09-11 allowing attackers to execute arbitrary code via crafted path to computerwritefile...

CVE-2026-63898

A flaw was found in the Linux kernel's mctu232 USB serial driver. A malicious USB device could exploit this vulnerability by reporting a smaller endpoint maximum packet size than the driver expects. This incorrect handling of transfer sizes can lead to memory corruption, potentially allowing an...

CVE-2026-63899

A flaw was found in the Linux kernel's USB serial mxuport driver. A malicious Universal Serial Bus USB device could exploit this vulnerability by reporting a bulk-out endpoint maximum packet size smaller than eight bytes. This can lead to user-controlled slab corruption, potentially allowing an...

CVE-2026-63453

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-44880

A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-63453

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system...

CVE-2026-47398 PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj added the PRAISONAIALLOWLOCALTOOLS env-var gate to the tooloverride.py sinks. However, two additional spec.loader.execmodule call sites in praisonai/agentsgenerator.py were...

CVE-2026-28304 SolarWinds Serv-U Remote Code Execution Vulnerability

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments...