CVE-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...

mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

NSA Ghidra Parameter Injection Vulnerability

NSA Ghidra is an open-source reverse-engineering tool developed by the National Security Agency National Security Agency of the United States. Prior to version 12.1 of NSA Ghidra, there was a parameter injection vulnerability. This vulnerability stemmed from improper escaping of the ‘cmd.exe’...

Teldat-Router-CVE-2022-POC

Teldat Router CVE-2022-39996 & CVE-2022-39997 POC Proof of...

CVE-2026-50265

CVE-2026-50265 describes a local privilege escalation in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties via the libinput-device-group helper, which can lead to root code execution (e.g., through REMOVE_CMD properties executed when a device is removed). ...

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...

0x20bf (0.0.1), 2keys (0.5.1) +3454 more potentially affected by CVE-2026-34993 via aiohttp (>=3.0.0b0, <=3.13.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-34993 Source advisory: OSV:GHSA-JG22-MG44-37J8...

0x20bf (0.0.1), 2keys (0.5.1) +3454 more potentially affected by CVE-2026-34993 via aiohttp (>=3.0.0b0, <=3.13.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-34993 Source advisory: GHSA-JG22-MG44-37J8...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...

Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

EUVD-2026-33500

A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSysCmd of the file /goform/formSysCmd. Such manipulation of the argument sysCmd leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and ma...

TRENDnet TEW-432BRP Security Vulnerabilities

TRENDnet TEW-432BRP is a dual-band wireless router produced by the TRENDnet company. Version 3.10B20 of TRENDnet TEW-432BRP has a security vulnerability. This vulnerability stems from a parameter in the function formSysCmd, specifically the submit-url field in the file/goform/formSysCmd, which...

PT-2026-45193

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSysCmd of the file /goform/formSysCmd. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made...

CVE-2026-45324

Rizin (librz) contains a memory-management flaw: a double free in cmd_search.c:byte_pattern_search() caused by incorrect pointer ownership. This is a concrete vulnerability entry for CVE-2026-45324. Impact is guidance-labeled as LOW (per CVSS 3.1: AV:P/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L). The issue h...

CVE-2026-45324: Double Free

Rizin is a UNIX-like reverse engineering framework and command-line toolset. There is a double free in librz/core/cmd/cmdsearch.c:bytepatternsearch due wrong pointer ownership declared. This vulnerability is fixed by commit 045fff363b42b8a6dda8ad5229c29ec3267e7dbe...

openSUSE 16 Security Update : apache2 (openSUSE-SU-2026:20810-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20810-1 advisory. Changes in apache2: Version update to 2.4.66 jscPED-16181 SECURITY: CVE-2025-66200: Apache HTTP Server: moduserdir+suexec bypass via AllowOverri...

CVE-2025-48977

Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log path crafted in a certain way. This issue affects Apache Ignite: from 2.0.0 through 2.17.0. Users are recommended to upgrade to version...