463965 matches found
VulnCheck KEV: CVE-2026-96656
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...
Roundcube Webmail 1.6.10 PHP Object Deserialization
Roundcube Webmail version 1.6.10 contains a post-authentication PHP object deserialization vulnerability that can allow arbitrary command execution. Included are a CTF environment and proof of concept exploit. https://packetstorm.news/download/236152...
CVE-2026-78497: Improper Neutralization of Directives in Dynamically Evaluated Code
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval. The pattern given to test, match, or the match and = conditions of select is placed in a qr'...' literal and compiled as source text, so a ? ... code block in it run...
Linux Distros Unpatched Vulnerability : CVE-2026-98760
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after...
Security update for pgvector (important)
openSUSE security update: security update for pgvector ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22065-1 Rating: important References: bsc1284129 Cross-References: CVE-2026-103484 CVSS scores: CVE-2026-103484 SUSE : 8.8...
CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791972286)
The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791972286 advisory. - rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who c...
CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791971338)
The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791971338 advisory. - rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destinatio...
Exploit for Deserialization of Untrusted Data in Roundcube Webmail
CVE-2025-49113 — ROUNDMAIL INCIDENT Roundcube PHP 객체 역직렬화 R...
Exploit for CVE-2026-53995
CVE-2026-53995: MLflow starttracev3 - TraceInfo.from...
yova_ps5
YOVA PS5 - Relapse Exploit Suite YOVA PS5 is a modern, hi...
cups: cups: Arbitrary code execution via newline injection in printer status messages
A flaw was found in CUPS. A remote attacker controlling a network printer can achieve arbitrary code execution by returning crafted printer status messages containing newline characters. The CUPS Internet Printing Protocol IPP backend fails to sanitize line breaks in status attributes, allowing...
cups: cups: Arbitrary file overwrite via insecure temporary file handling
A flaw was found in CUPS. Insecure temporary file handling allows a local attacker with print administrative privileges to overwrite arbitrary system files. When configuring a printer, the print service creates a temporary file with a predictable name in a shared directory without verifying wheth...
WSO2 Enterprise Integrator command injection vulnerability
WSO2 Enterprise Integrator has a command injection vulnerability. This vulnerability stems from improper input validation in the Management Console’s handling of JDBC user storage configurations. It may allow attackers to execute arbitrary code on affected servers with WSO2 product privileges...
WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin MapSVG versions = 8.16.1...
WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Peter Tang in WordPress Plugin MapSVG versions = 8.16.1...
WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability
Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Passakorn Yookindee in WordPress Plugin User Registration versions = 5.2.8...
CVE-2026-106470
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...
CVE-2026-104246
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...
EUVD-2026-103256
The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...
CVE-2026-104246 Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments
The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...