503013 matches found
Astra Linux – Vulnerability in Chromium
Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The use of after-free in the DOM in Google Chrome before version 148.0.7778.179 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of after-free in ANGLE in Google Chrome before version 148.0.7778.216 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
The use of after-free in Fonts in Google Chrome on Linux before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...
CVE-2026-16745
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
CVE-2026-16745
A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI RHOAI. Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This allows an attacker to gain unauthorize...
Deserialization of Untrusted Data
Overview com.alibaba:fastjson is a fast JSON parser/generator for Java. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the JSON parsing path in JSON.parse, JSON.parseObjectString, and JSON.parseObjectString, Class when it runs inside a Spring Boot...
Exploit for CVE-2026-56121
CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.load...
GHSA-CRF3-V9RR-V7HJ fastjson has a remote code execution (RCE) vulnerability
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
CVE-2026-16723
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
EUVD-2026-47919
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...
CVE-2026-16723 Remote Code Execution in fastjson 1.2.68–1.2.83
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
CVE-2026-16723
CVE-2026-16723 is a remote-code-execution vulnerability in Fastjson 1.2.68–1.2.83 that is exploitable under stock/default configuration without AutoType or a gadget. Connected docs confirm the attack chain can occur in Spring Boot fat‑JAR deployments: an attacker controls the @type value, Fastjso...
CVE-2026-16723
A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...
dogtag-pki security update
An update is available for dogtag-pki. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list IdM PKI is an enterprise software system designed to manage enterprise...
RLSA-2026:43400 Important: dogtag-pki security update
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: Certificate Authority CA Key Recovery Authority KRA Online Certificate Status Protocol OCSP Manager Token Key Service TKS Token Processing...
Johnson Controls C-CURE 9000 and Victor application server (Update A)
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds...
F5 BIG-IP iControl - REST Auth Bypass RCE
F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, may allow undisclosed requests to bypass iControl REST authentication. id: CVE-2022-1388 info: name: F5 BIG-IP...