214530 matches found
CVE-2026-42215
A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments kwargs to functions such as Repo.clonefrom, Remote.fetch, Remote.pull, or Remote.push. This...
EUVD-2026-60110
opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...
EUVD-2026-60083
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...
EUVD-2026-60077
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
BIT-PYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
BIT-JRE-2026-60526
Vulnerability in Oracle Java SE component: Installation. Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE...
BIT-JRE-2026-47021
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...
BIT-DOTNET-SDK-2026-62909 .NET Elevation of Privilege Vulnerability
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...
BIT-DOTNET-SDK-2026-62897 .NET Framework Remote Code Execution Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally...
BIT-DOTNET-2026-62897 .NET Framework Remote Code Execution Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally...
BIT-DOTNET-SDK-2026-62871 .NET Elevation of Privilege Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally...
BIT-DOTNET-SDK-2026-58641 .NET Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally...
CVE-2026-73072
A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the setsofo function fails to reset internal data between sections, leading to an out-of-bounds write...
vim: Vim: Arbitrary code execution via Python omni-completion
A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...
EUVD-2026-60445
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module...
PT-2026-73274
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...
CVE-2026-51346
StudIP (learning management system) has a SQL injection in its store() functions, affecting 6.0.x before 6.0.3 and 5.4.x before 5.4.12. CVSS 9.1 (network, no auth) allows unauthenticated remote attackers to execute arbitrary code and exfiltrate data. CISA SSVC flags it as PoC, automatable, total ...
PT-2026-76865
Name of the Vulnerable Software and Affected Versions hermes-studio version 0.6.26 Description A directory traversal issue allows a remote attacker to obtain sensitive information. This occurs through the validatePath function within the 'api/hermes/download' endpoint. Directory traversal is a fl...