Apache HTTP Server - Remote Code Execution

Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in modproxyuwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests. id: CVE-2020-1198...

Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

CVE-2026-54666 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...

SUSE-SU-2026:3237-1 Security update for vim

This update for vim fixes the following issues - Updated to version 9.2.0780. - CVE-2026-59856: Arbitrary Code Execution via PHP Omni-Completion bsc1271194. - CVE-2026-59857: Out-of-bounds Write in SAL Soundfolding bsc1271195. - CVE-2026-59858: Arbitrary Code Execution via C Omni-Completion...

MiracleLinux 8 : dotnet10.0-10.0.110-1.el8_10 (AXSA:2026-1334:13)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1334:13 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

RockyLinux 8 : pki-deps:10.6 (RLSA-2026:43218)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:43218 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 Tenable has extracted the preceding description block directly...

Microsoft Excel code execution vulnerability (CNVD-2026-28559)

Microsoft Excel is a spreadsheet software within the Office suite developed by the American company Microsoft. There is a code execution vulnerability in Microsoft Excel, and attackers can exploit this vulnerability to execute arbitrary code...

Microsoft Excel code execution vulnerability (CNVD-2026-28615)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Excel has a code execution vulnerability, which stems from the use of resources...

Microsoft Office Code Execution Vulnerability (CNVD-2026-28485)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has a code execution vulnerability, which stems from the use of incompatible...

Refuel Autolab Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code...

MiracleLinux 8 : nginx:1.24 (AXSA:2026-1164:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1164:01 advisory. nginx: ngxhttprewritemodule: code execution and denial of service CVE-2026-9256 Tenable has extracted the preceding description block directly from the...

Important: nginx:1.26 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: ngxhttprewritemodule: code execution and denial of service CVE-2026-9256 For more details about the security issues, including the impac...

Multiple Mozilla product code execution vulnerabilities (CNVD-2026-26107)

Mozilla Firefox is an open-source web browser. Mozilla Firefox ESR is a extended support version of Firefox the web browser. Mozilla Thunderbird is an email client software that was separated from the Mozilla Application Suite. Several Mozilla products have code execution vulnerabilities, and...

Microsoft Hyper-V Code Execution Vulnerability (CNVD-2026-24919)

Microsoft Hyper-V is an application developed by the American company Microsoft. It is a system management program that enables desktop virtualization. There is a code execution vulnerability in Microsoft Hyper-V, and attackers can exploit this vulnerability to execute arbitrary code on the syste...

Microsoft Excel code execution vulnerability (CNVD-2026-24916)

Microsoft Excel is a spreadsheet software within the Office suite developed by the American company Microsoft. There is a code execution vulnerability in Microsoft Excel, and attackers can exploit this vulnerability to execute arbitrary code on the system...

Microsoft Office Code Execution Vulnerability (CNVD-2026-24912)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. There is a code execution vulnerability in Microsoft Office, which is caused by improper...

CVE-2026-49382

CVE-2026-49382 affects JetBrains IntelliJ IDEA prior to 2026.1. The issue allows code execution via template injection in the Copyright plugin. This is the concrete vulnerability described across trusted sources; no exploit details are provided in the connected documents. The core root cause is t...

Microsoft Office Code Execution Vulnerability (CNVD-2026-23632)

Microsoft Office is a suite of office software products developed by Microsoft Corporation in the United States. Common components of this product include Word, Excel, Access, PowerPoint, and FrontPage. Microsoft Office has a code execution vulnerability, which allows attackers to execute arbitra...

WordPress GWD Conex plugin <= 2.9 - Unauthenticated Limited Code Execution vulnerability

Unauthenticated Limited Code Execution vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin GWD Conex versions = 2.9...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pillow (UTSA-2026-017334)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017334 advisory. PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be...