2237554 matches found
CVE-2026-27565 Remote code execution via uploading a malicious IODD file
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...
CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27556 Local File Inclusion in /index.php/ajax/save_iodd_parameters
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...
EUVD-2026-80239
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27556
A local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint of a VDE (Verband der Elektrotechnik) device allows a low-privileged remote attacker with a valid operator cookie to execute arbitrary PHP code on the device. The CNA is cert.vde.com , and related advisories...
EUVD-2026-80238
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27555
CVE-2026-27555 is a Local File Inclusion (LFI) vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker holding a valid user cookie can exploit it to achieve arbitrary PHP code execution on the device. The CVSS 3.1 base score is 8.8 (HIGH) , with network ...
CVE-2026-27555 Local File Inclusion in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40972)
Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40972 Vulnerability Details CVEID:CVE-2026-40972 DESCRIPTION: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. ...
CVE-2022-24434_POC
CVE-2022-24434 – PoC for Dicer This repository contains a Proof-of-Concept PoC for CVE-2022-24434 , a vulnerability affecting the Dicer npm package. PoC target version: 0.3.1 ensure the dicer code used is exactly v0.3.1 📂 Project Structure Make sure the directory is structured like this: . ├──...
CVE-2026-2441
CVE-2026-2441 — Use-After-Free en Chrome CSSFontFeatureValuesMap CVSS 8.8 Alto | Explotado activamente en la naturaleza | RCE del Renderer Sandboxeado Una vulnerabilidad de use-after-free en el motor CSS Blink de Google Chrome que permite a un atacante remoto ejecutar código arbitrario dentro del...
Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40973, CVE-2026-40975, CVE-2026-40977)
Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40973, CVE-2026-40975, CVE-2026-40977 Vulnerability Details CVEID:CVE-2026-40973 DESCRIPTION: A local attacker on the same host as the application may be able to take control of the directory used by...
java-deserialization-notes
Notes on Replicating Java Deserialization Vulnerabilities S...
CVE-2026-92355
Octopus Server is affected by a path traversal flaw in the handling of non built-in external feeds. A user with low privileges (specifically, permission to modify non built-in external feeds) can exploit this to overwrite arbitrary files on the server. In some configurations, this may escalate to...
CVE-2026-92355
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
EUVD-2026-80225
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
CVE-2026-92355
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata
A flaw was found in Tesseract, an open-source Optical Character Recognition OCR engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer...