ms-365-mcp-server-PoC

ms-365-mcp-server: security advisory CVE status: reques...

CVE-2026-85137: Improper Control of Generation of Code

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

PT-2026-85022

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

PT-2026-85075

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms locoy news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

TencentOS Server 3: perl-DBI:1.641 (TSSA-2026:0971)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0971 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Fedora 45 : dracut (2026-5bf73fe397)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5bf73fe397 advisory. - fixdevicetree-firmware: include soc specific firmwares in installgeneric - fixdevicetree-firmware: include Qualcomm X2 laptop model specific firmwares -...

Exploit for Code Injection in Langflow

P...

EUVD-2026-62600

Orval: Import-time RCE via query-parameter default - zod module-level template literal...

EUVD-2026-62596

Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client...

GHSA-6MR6-JVCR-2F25 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

Malicious Package

Overview bellatrix-upgrade-janus-dynamo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview bella-lontong60-breki is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Arbitrary Code Injection

Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...

CVE-2026-58572

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-18808

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

CVE-2026-58572

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-58572

Dell PowerStore is affected by a Code Injection vulnerability (CVE-2026-58572). An authenticated user with limited privileges can exploit this flaw to execute arbitrary code with root privileges , resulting in high impact across confidentiality, integrity, and availability. The attack requires lo...

EUVD-2026-69131

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-58572

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-18808 Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...