CVE-2026-113870

MongoDB Compass is vulnerable to arbitrary code execution due to improper escaping of certain BSON values when converting a stored view’s aggregation pipeline into an editable source. An attacker can trigger this by providing a specially crafted view within a MongoDB deployment. If a user connect...

EUVD-2026-107468

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

CVE-2026-114113

A flaw was found in sharp. The library includes a bundled version of libvips affected by multiple vulnerabilities within its GIF, TIFF, and VIPS image decoders. An attacker can exploit this by supplying a specially crafted image file to an application processing untrusted input, which may lead to...

CVE-2026-114112

A flaw was found in sharp. An attacker can exploit this vulnerability by submitting specially crafted AV1 Image File Format AVIF or High-Efficiency Image File Format HEIF images to applications processing untrusted media. Due to memory corruption during image decoding in a bundled library,...

CVE-2026-114098

A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into restoring a stash in a specially crafted Git repository. During a stash pop operation, intermediate directory symbolic links symlinks are followed without adequate...

CVE-2026-113300

A flaw was found in the Forms component of chromium-browser. This vulnerability allows a remote attacker to achieve arbitrary code execution outside of the browser security sandbox. By tricking a user into visiting a specially crafted HTML page, an attacker can trigger an out-of-bounds memory wri...

CVE-2026-114094

A flaw was found in Dulwich. On Windows systems, the application fails to validate drive letter prefixes within repository paths during checkout operations. A remote attacker could exploit this flaw by enticing a user to clone or check out a specially crafted Git repository containing malicious...

CVE-2026-113222

A flaw was found in Chromium's V8 engine. A remote attacker could exploit this use-after-free vulnerability by convincing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to execute arbitrary code outside the browser sandbox...

CVE-2026-113189

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside the browser sandbox by enticing a user to visit a specially crafted HTML page. The issue stems from a use-after-free memory management vulnerability in the Core component, which ca...

php2shell-checker-claude

Instrucciones en español al final PHP2Shell C...

Exploit for CVE-2026-109618

PHP2Shell: Two Days of Records – From Exposure, Previews to Pa...

Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...

GHSA-F2PH-CMG5-WXC8 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...

npm: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites

npm: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites vulnerability discovered by ? in WordPress npm storybook versions = 8.0.0, 8.6.19...

CVE-2026-114126

The Storybook development server is vulnerable to a security flaw where it exposes its WebSocket authentication token to clients on the local network. Affected versions include 8.0.0 to 8.6.18 , 9.1.21 , 10.6.2 , and 11.0.0-alpha.6 . A LAN attacker can obtain this token to access WebSocket-backed...

CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-76494

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered...

EUVD-2026-107407

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target mus...

CVE-2026-92202

The Luxion KeyShot software is vulnerable to Remote Code Execution (RCE) due to an uncontrolled search path element during the parsing of BIP files . The flaw occurs because the application loads a library from an unsecured location, which an attacker can exploit to execute arbitrary code in the ...