CVE-2026-78463

Microsoft Remote Desktop Client is affected by a code injection vulnerability (improper control of generation of code) that allows an unauthorized attacker to execute code over a network . The CNA (Microsoft) rates this as CVSS 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning e...

CVE-2026-77908

CVE-2026-77908 is a code injection vulnerability in Microsoft Dynamics 365 On-Premises that allows an authorized attacker (low privileges) to achieve remote code execution over a network. The flaw stems from improper control of code generation, and the CVSS 3.1 score is 8.8 (HIGH) with impacts ra...

EUVD-2026-73294

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

Remote Desktop Client Remote Code Execution Vulnerability

Improper control of generation of code 'code injection' in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

Exploit for CVE-2026-57811

CVE-2026-57811 — Realtyna Organic IDX + WPL Real Estate Unauth...

Important: Red Hat Security Advisory: gpsd security update

An update for gpsd is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility

A flaw was found in gpsd. This code injection vulnerability in the gpsprof utility allows an attacker to execute arbitrary operating system OS commands. By controlling GPS input data, an attacker can inject malicious content into the SKY.satellites.used field. This unsanitized input is then...

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 CVSS score: 10.0, has been codenamed StyleSmuggler by Sansec, which...

POC

CVE-2025-71389 — Cal.com Unauthenticated RCE via Next.js RSC D...

ALSA-2026:65606 Important: gpsd-minimal security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The AlmaLinux support for this package is limited...

Koha Eval Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper...

PT-2026-88528

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description An issue exists in the web service that listens on TCP port 8081 by default, where a lack of proper validation of a user-supplied string before it is passed to the eval function allows...

PT-2026-88499

Impact Two stages of expression code generation built source text by calling the global JSON.stringify at generation time: the compiler when printing synthetic string literals, and the isolate bridge when interpolating a timezone value into its per-evaluation wrapper. An expression that replaced...

RHEL 9 : gpsd-minimal (RHSA-2026:65606)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65606 advisory. gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the...

RHEL 10 : gpsd (RHSA-2026:65162)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65162 advisory. gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the...

CVE-2026-77908: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

PT-2026-87982

Improper control of generation of code 'code injection' in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

PT-2026-87938

Animate is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requir...

CVE-2026-76191: Improper Control of Generation of Code

Animate is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requir...