gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.96, using free in the UI of Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in DataTransfer in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Views in Google Chrome on Linux before version 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code through a crafted Chrome Extension. Chromium security severity: Critical...

CVE-2026-16745

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...

CVE-2026-16745

A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...

CVE-2026-65756

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript...

CVE-2026-15786

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-47903

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-15786 WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-15786

CVE-2026-15786 affects the WordPress plugin “WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan.” All versions up to 7.8.6.6 are vulnerable to Directory Traversal via the “imploded” parameter. With administrator-level access, an authenticated attacker could...

CVE-2026-15786 WP Encryption <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter

The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.8.6.6 via the 'imploded' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-47913

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript...

Exploit for Path Traversal in Jugmac00 Flask-Reuploaded

CVE-2026-27641 is a critical security vulnerability affecting ve...

CVE-2026-14282

The CVE describes a vulnerability in the GoDAM WordPress plugin (versions up to and including 1.12.2) where an insufficient file type validation in save_video_file() (hooked to WPForms process) trusts the attacker-controlled Content-Type header, preserves the original filename via wp_unique_filen...

EUVD-2026-47919

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...

CVE-2026-16078

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the...

CVE-2026-16078

CVE-2026-16078 affects the WCPOS

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...