CVE-2026-76682: Buffer Copy without Checking Size of Input

A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or potentially execute arbitrary code on th...

CVE-2026-76676: Stack-based Buffer Overflow

Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attack...

CVE-2026-12354: Improper Control of Dynamically-Managed Code Resources

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to...

CVE-2026-11728: Out-of-bounds Write

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in t...

CVE-2026-21587: Improper Authorization

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

CVE-2026-21586: Improper Authorization

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

CVE-2026-55887: Improper Neutralization of Argument Delimiters in a Command

MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...

CVE-2026-61668: Improper Certificate Validation

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl.createunverifiedcontext to download the second-stage pilot.tar archive without TLS certificat...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to achieve arbitrary code execution . The vulnerability exists within the FlwTaskController.java component and is triggered through several specific components and endpoints: FlwTaskServiceImpl.completeTask , CompleteExecuteComponent.proce...

CVE-2026-12728: Deserialization of Untrusted Data

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted...

CVE-2026-52484: Improper Neutralization of Special Elements used in an OS Command

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

CVE-2026-52484

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

PT-2026-91930

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

PT-2026-116260

Уязвимость программного средства для взаимодействия с серверами cURL связана с использованием памяти после освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

CVE-2026-52484

The MitraStar GPT-2742GX4X5v6-SV router, running firmware GL_g2.5_100XNT0b23_3 , contains a command injection vulnerability in the /cgi-bin/device-management-utilities-internet.cgi component. An authenticated attacker can execute arbitrary code by bypassing special character filters using URL-enc...

CVE-2026-92248: Integer Overflow or Wraparound

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

CVE-2026-88618

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...

CVE-2026-88618

The 1024-lab SmartAdmin v3.30.0 software is affected by a stored cross-site scripting (XSS) vulnerability within its file upload functionality . This flaw allows a remote attacker to achieve arbitrary code execution . No specific remediation, exploit links, or detailed technical root causes are p...

PT-2026-93111

Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...

PT-2026-95727

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp versions 1.0 through 1.52.4 Description A privilege escalation issue exists that allows local users with permission to create VPN connections to execute arbitrary code as root. An attacker can inject pppd options by using a...