BIT-POSTGRESQL-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

BIT-POSTGRESQL-2026-14669 PostgreSQL to_char heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

BIT-POSTGRESQL-2026-14664 PostgreSQL regexp heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...

BIT-POSTGRESQL-2026-14662 PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These...

MOODLE-3.X-Remote-Code-Execution

MOODLE-3.X-Remote-Code-Ausführung cve-2018-1133 moodle authentifiziert als Lehrer Remote-Code-Ausführung...

BIT-JUPYTERLAB-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14...

GHSA-F3QQ-49M6-RW8F

creationtimestamp| type| source ---|---|--- 2026-08-19 08:31:37+00:00| seen| https://gist.github.com/alon710/db3f4019c2372dbb6dfede560d6093f7...

CVE-2026-76043

A flaw was found in the V8 component of Google Chrome. A remote attacker could exploit an incorrect calculation vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution within the browser's sandbox environment...

CVE-2026-76040

A flaw was found in chromium-browser. This use-after-free vulnerability allows a remote attacker, through social engineering, to execute arbitrary code outside of the sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a complete compromise of the affected system...

CVE-2026-76036

A flaw was found in Dawn in Google Chrome on Android. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page...

Eaton-Intelligent-Power-Manager-Local-File-Inclusion

Eaton-Intelligent-Power-Manager-Local-File-Inclusion Local File Inclusion in Eaton Intelligent Power Manager v1.6 ermöglicht es einem Angreifer, eine Datei einzubinden, was zur Offenlegung sensibler Informationen, Denial-of-Service und Codeausführung führen kann. CVE-2018-12031 Um die Schwachstel...

ezwinrar

ezwinrar Python-Tool, das CVE-2018-20250 ausnutzt, gefunden von den CheckPoint-Leuten : https://research.checkpoint.com/extracting-code-execution-from-winrar/ Durch das Manipulieren des Dateinamenfelds des ACE-Formats wird der Zielordner Extraktionsordner ignoriert und der relative Pfad im...

CVE-2024-46538

Este post é um artigo de pesquisa publicado por EQSTLab. Agradecimentos aphysicszq, que descobriu esta vulnerabilidade. CVE-2024-46538 ★ CVE-2024-46538 PfSense XSS Armazenado leva à Execução Arbitrária de Código PoC ★ https://github.com/user-attachments/assets/f41d0945-b7f4-4f88-bac5-265904256aae...

CVE-2026-76044

A flaw was found in Google Chrome's USB component. A remote attacker, after compromising the renderer process, could exploit a race condition by using a specially crafted HTML page. This could potentially lead to the execution of arbitrary code outside of the browser's security sandbox, allowing...

CVE-2026-45135

A flaw was found in Caddy. This vulnerability stems from unsafe handling of Unicode characters within the FastCGI component, specifically when processing request paths containing non-ASCII bytes. An attacker capable of placing content into files served via FastCGI can exploit this by crafting a...

cve-2024-25423

cve-2024-25423 Проблема в MAXON CINEMA 4D R2024.2.0 позволяет локальному злоумышленнику выполнить произвольный код с помощью специально созданного файла c4d. Дополнительная информация Уязвимость выхода за границы записи в Cinema 4D при разборе файлов c4d Затронутый компонент c4dbase.xdl64...

CVE-2016-2098-my-first-exploit

CVE-2016-2098-my-first-exploit Este exploit é uma vulnerabilidade de execução remota de código no Ruby-on-Rails ao usar render em dados fornecidos pelo usuário. Está escrito em python3, e lembre-se de instalar a biblioteca requests. aqui está o comando. root@kitploit: pip3 install requests...

CVE-2026-72492

A flaw was found in ksmbd, the in-kernel SMB3 server for Linux. This memory corruption vulnerability, known as a use-after-free, occurs when the system attempts to use memory after it has been released. A remote attacker could trigger this by performing a concurrent close operation during lease...

MAL-2026-14274 Malicious code in reqcrypt-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...