CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic...

EUVD-2026-92133

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

PT-2026-106192

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

EUVD-2026-92786

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

EUVD-2026-92441

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

PT-2026-106001

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

ROS-20261005-73-0090

The vulnerability in dotnet9.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261005-73-0094

The vulnerability in dotnet10.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261005-73-0089

The vulnerability in dotnet10.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261005-73-0095

The vulnerability in dotnet9.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261005-73-0088

The vulnerability in dotnet8.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261005-73-0093

The vulnerability in dotnet8.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-104733

YAML versions before 1.27 001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

PT-2026-106241

Name of the Vulnerable Software and Affected Versions AMD Zynq™ UltraScale+ MPSoC affected versions not specified AMD RFSoC affected versions not specified Description Insufficient boundary validation in the USB boot mode implementation allows unbounded Device Firmware Upgrade DFU download reques...

CVE-2026-78860

The Mercusys AC12 V2 is affected by a vulnerability that allows a local attacker to achieve arbitrary code execution . The root cause is identified as the storage of information in plaintext , which is associated with CWE-311 (Missing Encryption of Sensitive Data) and CWE-347 (Improper Verificati...

EUVD-2026-92785

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

PT-2026-106146

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the wpas handle robust av scs recv action function within robust av.c allows for a possible out-of-bounds write. This condition could enable...

VulnCheck KEV: CVE-2026-95675

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

CVE-2026-105740: Improper Neutralization of Special Elements used in an OS Command

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...