CVE-2026-84502 Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

EUVD-2026-85542

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71465 Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71465 Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...

CVE-2026-71464 Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard

LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check defense-in-depth, but the API...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

CVE-2026-96513 Neethuharii CafeManagement AddProductCode.php unrestricted upload

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick , combines an SSH state-machine flaw CVE-2026-67279 with an...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

CVE-2026-96258

A cross-site scripting (XSS) vulnerability exists in the Public Password Reset Endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722). The flaw is located within the /forgotpasswd.html file, where manipulating the email argument allows for remote execution of the a...

CVE-2026-96258 onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting

A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...

EUVD-2026-84988

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

EUVD-2026-84987

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

CVE-2026-95833

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-95830

A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /postupload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The explo...

CVE-2026-84724: Improper Neutralization of Argument Delimiters in a Command

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

CVE-2026-87900: Improper Neutralization of Argument Delimiters in a Command

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts...