CVE-2026-7861: Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM Customer Service Management allows Code Injection. This issue affects CSM Customer Service Management: before 8.0.3...

Exploit for Code Injection in Grafana

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write t...

OESA-2026-3655 libtiff security update

This provides support for the Tag Image File Format TIFF, a widely used format for storing image data. The latest version of the TIFF specification is available on-line in several different formats.And contains command-line programs for manipulating TIFF format image files using the libtiff...

OESA-2026-3630 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

OESA-2026-3631 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

OESA-2026-3628 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

OESA-2026-3629 perl-DBI security update

The DBI is the standard database interface module for Perl. It defines a set of methods, variables and conventions that provide a consistent database interface independent of the actual database being used. It is important to remember that the DBI is just an interface. The DBI is a layer of "glue...

Exploit for Code Injection in Langflow

No d...

Exploit for Code Injection in Langflow

Description PoC...

CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-85654

Amazon awslabs.dynamodb-mcp-server contains a code injection vulnerability in its CDK generator component. The root cause is improper neutralization of special elements used in a template engine , allowing a context-dependent actor to execute arbitrary code on the host that deploys the generated ...

CVE-2026-85654 Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute...

CVE-2026-75161

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection in the sort filter due to improper handling of the isSandboxed argument in the sortFunc wrapper. An attacker can...

Malicious Package

Overview damasco is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview array-frames is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Exploit for Code Injection in Langflow

PO...

CVE-2026-75161

The MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) is vulnerable to an arbitrary code execution flaw. The issue exists within the ugw-restart method of the /cgi-bin/wwwugw.cgi component. A remote authenticated user with a low-privileged Standard role can exploit this flaw to inject arbitrary ...

CVE-2026-75161

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...

EUVD-2026-71454

An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root...