CVE-2026-17156

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to insecure deserialization...

CVE-2026-16428

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine...

CVE-2026-54334 UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...

CVE-2026-54334 UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBitsSd, CBIT with CBIT = 9 and can obtain 511 entries for the 510-element Sd-mCLen heap...

CVE-2026-54334

CVE-2026-54334 is a heap out-of-bounds write in the uefi-firmware Python package's native Tiano/EFI decompressor. The flaw is in ReadCLen() within uefi_firmware/compression/Tiano/Decompress.c: it reads a 9-bit value (up to 511) and writes into the 510-element Sd->mCLen heap array without bound...

CVE-2026-54333 UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-54333 UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable in uefifirmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream rema...

CVE-2026-54333

CVE-2026-54333 is a stack out-of-bounds write in the uefi-firmware Python package (UEFI Firmware Parser). The vulnerable function MakeTable() in uefi_firmware/compression/Tiano/Decompress.c fails to validate that bit-length values from a crafted Tiano/EFI compressed firmware bitstream stay within...

EUVD-2026-77810

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028

Magistrala versions before 1.0.0 are affected by a SQL injection in the timescale-reader and postgres-reader HTTP API services. The root cause is a malicious format query parameter interpolated directly into the FROM clause without parameterization or identifier quoting. An authenticated attacker...

CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-50006

CVE-2026-50006 affects Anyquery (github.com/julien040/anyquery), an SQL query engine built on SQLite. In server mode prior to 0.4.5 , the MySQL-compatible port forwards unauthenticated SQL to SQLite without restricting ATTACH DATABASE filesystem targets. A remote, unauthenticated attacker can spe...

CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

CVE-2026-50006 Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

CVE-2026-16428 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine...

EUVD-2026-77793

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine...

CVE-2026-16428

IBM DataStage on Cloud Pak for Data (version 5.4.0.0 ) is vulnerable to arbitrary code execution due to improper configuration of the XSLT transformation engine , classified as CWE-94 (Code Injection). A remote authenticated attacker can exploit this over the network with low complexity and no us...

Fuel-CMS-Remote-Code-Execution-1.4--RCE--

This repository does not have a README...

bluefire-sharepoint-cve-2025-53770

🔐 Bluefire Redteam – SharePoint CVE-2025-53770 Detection & Remediation Toolkit This open-source toolkit provides security teams with battle-tested scripts to detect, assess, and remediate the critical SharePoint zero-day vulnerability CVE-2025-53770 CVSS 9.8 — currently being exploited in the wil...