CVE-2026-50228: Active Debug Code

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

CVE-2026-84474: Reliance on Untrusted Inputs in a Security Decision

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret hostconfigkey is exposed to users holding only the read-level viewjobtemplate permission -- both in the job template API representation and in the activity stream -- and the...

MiracleLinux 8 : libtiff-4.0.9-39.el8_10 (AXSA:2026-1889:10)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1889:10 advisory. libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 Tenable has extracted the preceding description block directly from...

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, allows attackers to execute arbitrary code.

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, is related to the use of single-factor authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

RHEL 9 : vim (RHSA-2026:70818)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70818 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary Code Execution via crafted directo...

CVE-2026-96804: Deserialization of Untrusted Data

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

Linux Distros Unpatched Vulnerability : CVE-2026-91738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox v...

Linux Distros Unpatched Vulnerability : CVE-2026-91018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

The vulnerability of the printing control software in PaperCut MF and PaperCut NG, related to insecure dynamic class loading, allows a violator to execute arbitrary code.

The vulnerability of printing control software in PaperCut MF and PaperCut NG lies in the unsafe dynamic loading of classes, due to the lack of checks to ensure that the loaded classes comply with the list of allowed drivers. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2025-63564

The Moodle Socialwall plugin versions v.3.0 through v.3.3 are affected by a SQL injection vulnerability. An attacker can exploit this flaw by sending crafted HTTP requests , which may lead to the execution of arbitrary code . The vulnerability is classified with a CRITICAL base severity score of ...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...

CVE-2026-96775: Deserialization of Untrusted Data

MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

Debian dsa-6510 : xdg-dbus-proxy - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6510 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6510-1 [email protected] https://www.debian.org/security/ Albert...

MiracleLinux 9 : gstreamer1-plugins-base-1.22.12-8.el9_8.2 (AXSA:2026-1897:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1897:03 advisory. gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow CVE-2026-18297 gstreamer1-plugins-base: gstreamer:...

RHEL 8 : unbound (RHSA-2026:70754)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70754 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Remote Code...

Wireshark 4.4.x < 4.4.16 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.16 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 -...

Foxit Reader Array resetForm Use-After-Free Vulnerability

Summary A use-after-free vulnerability exists in the way Foxit Reader handles an Array object. A specially crafted JavaScript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick...

CVE-2018-17179-OpenEMR

CVE-2018-17179-OpenEMR ⚠️ Disclaimer This repository is intended strictly for educational and research purposes only. The information and code provided here can be used in controlled environments , such as private lab machines. Unauthorized use of this code against systems you do not own or have...

Shellshock_vuln_Exploit

🚨 Shellshock RCE Exploit CVE-2014-6271 This is a Python exploit for the Shellshock vulnerability CVE-2014-6271, which affects GNU Bash. The exploit targets CGI scripts on vulnerable web servers and establishes a reverse shell to the attacker's machine. CVE ID CVE-2014-6271 Disclaimer This tool is...

CVE-2025-3248

CVE-2025-3248: Langflow Ejecución Remota de Código RCE Sin Autenticación Este repositorio contiene dos scripts de Python: LangflowCheck.py: Un escáner que verifica instancias de Langflow AI vulnerables a CVE-2025-3248. exploit.py: Un exploit funcional de reverse shell para objetivos Langflow...