CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

LocalStranger

LocalStranger LocalStranger is a Proof of Concept project designed to demonstrate how dangerous a vulnerable kernel-mode driver actually is. WinNotify.sys as I call it, msft.sys, is a very dangerous vulnerable driver exposing arbitrary kernel primitives due to a complete lack of caller validation...

EUVD-2026-101496

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

CVE-2026-86461 FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

CVE-2026-92392

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.34.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.34.10...

CVE-2026-92153

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever...

CVE-2026-33798

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic...

CVE-2026-102055

A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent t...

CVE-2026-101955

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled...

EUVD-2026-101308

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

CVE-2026-101981

A Stack-based Buffer Overflow vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . When LDP is enabled , an unauthenticated adjacent LDP peer can exploit this flaw by sending a malformed LDP Label Mapping message . This could result in an r...

EUVD-2026-101416

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message...

EUVD-2026-101405

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic...

EUVD-2026-101388

A Stack-based Buffer Overflow vulnerability in the phone-home daemon phcd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. This issue only affects platforms that support...

CVE-2026-102037 Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used

An XML Injection vulnerability in the Unified Threat Management daemon utmd of Juniper Networks Junos OS on SRX Series devices allows an unauthenticated network attacker to commit arbitrary device configuration with root privileges via a malicious response from a configured custom URL-feed server...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads

Summary SPSS Collaboration and Deployment Services is affected by an Apache Ant vulnerability that could allow arbitrary file overwrite via malicious FTP/SCP downloads. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp task...