172776 matches found
CVE-2026-73693
FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...
CVE-2026-68487
Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...
Security Bulletin: IBM MQ Appliance is affected by an XML external entity injection vulnerability (CVE-2026-12666)
Summary IBM MQ Appliance has addressed an XML external entity injection vulnerability that could allow an authenticated attacker to obtain sensitive information or cause a denial of service when processing MQRFH2 headers. Vulnerability Details CVEID:CVE-2026-12666 DESCRIPTION: IBM MQ Classes for...
WordPress UsersWP plugin <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability
Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by daroo in WordPress Plugin UsersWP versions = 1.2.70...
Security Bulletin: IBM MQ Appliance is affected by a deserialization filter bypass vulnerability (CVE-2026-10751)
Summary IBM MQ Appliance has addressed a deserialization filter bypass vulnerability that could allow an authenticated attacker to execute arbitrary code on client applications. Vulnerability Details CVEID:CVE-2026-10751 DESCRIPTION: IBM MQ Java and JMS client libraries could allow an authenticat...
Security Bulletin: IBM MQ Appliance is affected by a heap buffer underflow vulnerability (CVE-2026-10858)
Summary IBM MQ Appliance has addressed a heap buffer underflow vulnerability that could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code when processing multi-segment messages. Vulnerability Details CVEID:CVE-2026-10858 DESCRIPTION: IBM MQ could...
Security Bulletin: IBM MQ Appliance is affected by an integer overflow vulnerability (CVE-2026-11725)
Summary IBM MQ Appliance has addressed an integer overflow vulnerability. Vulnerability Details CVEID:CVE-2026-11725 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing...
Security Bulletin: IBM MQ Appliance is affected by an integer overflow vulnerability in distribution list processing (CVE-2026-11378)
Summary IBM MQ Appliance has addressed an integer overflow vulnerability in distribution list processing that could allow an authenticated attacker to cause a denial of service or execute arbitrary code. Vulnerability Details CVEID:CVE-2026-11378 DESCRIPTION: IBM MQ could allow an authenticated...
Security Bulletin: IBM MQ Appliance is affected by a stack buffer overflow vulnerability in XA transaction identifier processing (CVE-2026-11375)
Summary IBM MQ Appliance has addressed a stack buffer overflow vulnerability that could allow an authenticated attacker to cause a denial of service or execute arbitrary code through malformed XA transaction identifiers. Vulnerability Details CVEID:CVE-2026-11375 DESCRIPTION: IBM MQ could allow a...
Command Injection
Overview awslabs.postgres-mcp-server is an An AWS Labs Model Context Protocol MCP server for postgres Affected versions of this package are vulnerable to Command Injection via the SQL validation process. An attacker can execute arbitrary operating system commands by submitting a specially crafted...
SUSE CVE-2026-61911
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired...
CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
CVE-2026-73699
FileRun before 2026.3.0 is affected by a PHP object injection vulnerability in the Perms::getPerms() method. The root cause is an incorrect option passed to unserialize() : a positional array is used instead of the required named-key array, failing to disable class instantiation. Authenticated at...
EUVD-2026-75601
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
CVE-2026-73699 FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms()
FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize in the Perms::getPerms method, where a positional array is used instead of the required named-key array to...
EUVD-2026-75598
FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...
CVE-2026-73693 FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...
CVE-2026-73693
FileRun before 2026.3.0 is vulnerable to OS command injection in the PhotoProofSheet handler. The root cause is a missing escapeshellarg() call when constructing the ImageMagick montage command, allowing authenticated users with upload permission to execute arbitrary commands by uploading files w...
CVE-2026-73693 FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler
FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...