CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

MINI-XPH6-PFRX-8JMH

Bulletin has no description...

MINI-RVHF-R9J9-F768

Bulletin has no description...

MINI-3QP8-H8V4-XWMH

Bulletin has no description...

MINI-67VR-9F29-FRGF

Bulletin has no description...

MINI-VJPG-5VFH-6JP9

Bulletin has no description...

MINI-6Q5C-WW5F-P86V

Bulletin has no description...

MINI-V8G4-5VGQ-88RR

Bulletin has no description...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

MINI-258P-7FXQ-H4G8

Bulletin has no description...

CVE-2026-52889

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form...

CVE-2026-48711

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as -oProxyCommand=CMD:/path and findbasepath removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line...

CVE-2026-16814

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow...

EUVD-2026-62525

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-16814

CVE-2026-16814 is a heap buffer overflow in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 that allows a remote attacker on an adjacent network to execute arbitrary code without authentication or user interaction. The CVSS 3.1 score is 8.8 (HIGH) with full impact on confidentiality, integrity, and ava...

EUVD-2026-62524

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow...

CVE-2026-16814 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow...

CVE-2020-10204

creationtimestamp| type| source ---|---|--- 2026-08-19 15:00:17+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-10204.yaml 2026-08-20 00:00:17+00:00| confirmed|...

CVE-2026-52889 Formie: Server-Side Template Injection in Formie Hidden field defaults

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form...

EUVD-2026-62518

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form...