Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

CraftCMS - Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

EUVD-2026-91868

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

CVE-2026-105080

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloadedrecipe file...

CVE-2026-105080

In ConvertX versions prior to 0.19.0 , the converters/calibre.ts component fails to block recipe files . Instead, it passes these files to the ebook-convert program from Calibre. This vulnerability allows for the execution of arbitrary code contained within .recipe or .downloaded_recipe files. Re...

EUVD-2026-91823

MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution...

EUVD-2026-91836

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

PT-2026-104576

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The legacy JAX-RPC SOAP interface contains an unauthenticated arbitrary class instantiation flaw. Remote attackers can send SOAP requests to the endpoint '/jaxrpc/' using an unverified session...

VulnCheck KEV: CVE-2026-97359

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

Linux Distros Unpatched Vulnerability : CVE-2026-103630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-103625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-47573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to...

Linux Distros Unpatched Vulnerability : CVE-2026-103622

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-103626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potential...

Linux Distros Unpatched Vulnerability : CVE-2026-102991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath,...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

PT-2026-104543

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.19 Description The plugin is susceptible to Local File Inclusion, a flaw that allows an attacker to include files from the local server. Authenticated...