Lucene search
+L

37055 matches found

Github Security Blog
Github Security Blog
added 2026/05/04 9:19 p.m.22 views

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

Summary The cleanUpString method in ConfigWriter.php uses an ungreedy regex to strip Liquidsoap string interpolation patterns ... from user input. This regex can be bypassed via nested interpolation syntax EXPR, allowing injection of arbitrary Liquidsoap code. Commit ff49ef4 migrated most...

6.4AI score
SaveExploits0References3Affected Software1
RedhatCVE
RedhatCVE
added 2026/05/04 8:21 p.m.10 views

CVE-2026-7595

A flaw has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this vulnerability is the function formatplugins of the file .claude/skills/ui-styling/scripts/tailwindconfiggen.py of the component Tailwind Config Generator. This manipulation causes code injection. The attac...

6.5CVSS6.2AI score0.00242EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/05/04 8:21 p.m.10 views

CVE-2026-7508

A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...

6.5CVSS6.3AI score0.00233EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/05/04 8:21 p.m.10 views

CVE-2026-7703

A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the component Websocket API. This manipulation causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 25.2 R3 is...

7.5CVSS6.7AI score0.00311EPSS
SaveExploits0References1
Snyk
Snyk
added 2026/05/04 8:14 p.m.31 views

Arbitrary Code Injection

Overview pyp2spec is a Generate a valid Fedora specfile from Python package from PyPI Affected versions of this package are vulnerable to Arbitrary Code Injection in the process of writing package metadata into the generated spec file without escaping RPM macro directives. An attacker can execute...

8.5CVSS6.1AI score0.00198EPSS
SaveExploits0References2
OSV
OSV
added 2026/05/04 8:14 p.m.22 views

GHSA-R35X-V8P8-XVHW pyp2spec is Vulnerable to Code Injection

Impact pyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. The macro...

7.8CVSS6.1AI score0.00198EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/05/04 8:14 p.m.15 views

pyp2spec is Vulnerable to Code Injection

Impact pyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. The macro...

7.8CVSS6.1AI score0.00198EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/05/04 6:30 p.m.7 views

GHSA-35XX-9XRG-GWHF Apache Atlas has a Code Injection Vulnerability

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas. Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data. Affected...

7.1CVSS5.8AI score0.00464EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/05/04 6:30 p.m.22 views

Apache Atlas has a Code Injection Vulnerability

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas. Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data. Affected...

8.1CVSS5.8AI score0.00464EPSS
SaveExploits0References4Affected Software1
Snyk
Snyk
added 2026/05/04 6:27 p.m.7 views

Arbitrary Code Injection

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection through the inspect function. An attacker can execute arbitrary commands on the host system by escaping the...

9.8CVSS6.3AI score0.01186EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/04 6:27 p.m.12 views

Arbitrary Code Injection

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection through the resetPromiseSpecies function. An attacker can execute arbitrary commands on the host system by escaping from the...

10CVSS7.8AI score0.03867EPSS
SaveExploits5References2
Snyk
Snyk
added 2026/05/04 6:27 p.m.7 views

Arbitrary Code Injection

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection via the SuppressedError. An attacker can execute arbitrary code outside the intended sandbox environment by...

10CVSS6.4AI score0.0071EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/04 5:28 p.m.8 views

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the DSL search endpoint. An attacker can execute arbitrary code by placing malicious Gremlin traversal logic within grammar-allowed characters to access unintended data. Note: This is only exploitable if the...

8.1CVSS6.2AI score0.00464EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 4:29 p.m.10 views

Arbitrary Code Injection

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection through the lookupGetter method and improper context isolation. An attacker can execute arbitrary commands o...

9.8CVSS6.3AI score0.00905EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/04 4:29 p.m.11 views

Arbitrary Code Injection

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Arbitrary Code Injection through the lookupGetter method and improper context isolation. An attacker can execute arbitrary commands on the host syste...

9.8CVSS6.3AI score0.00905EPSS
SaveExploits1References2
NVD
NVD
added 2026/05/04 4:16 p.m.10 views

CVE-2026-40563

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...

8.1CVSS0.00464EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/05/04 4:6 p.m.10 views

Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in activemq-all (CVE-2026-34197)

Summary IBM Sterling Control Center is affected by a vulnerability CVE-2026-34197 reported for activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-34197 DESCRIPTION: Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broke...

8.8CVSS7.9AI score0.9722EPSS
SaveExploits14Affected Software1
EUVD
EUVD
added 2026/05/04 3:17 p.m.9 views

EUVD-2026-26979

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...

7.1CVSS5.8AI score0.00464EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/05/04 3:17 p.m.5 views

CVE-2026-40563

Description: Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-supplied query strings. Attacker can alter Gremlin traversal logic within grammar-allowed characters to access unintended data Affect...

7.1CVSS5.8AI score0.00464EPSS
SaveExploits0References2Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/05/04 2:25 p.m.6 views

Security Bulletin: Vulnerability in Apache Avro Java SDK affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Apache Avro Java SDK has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

7.3CVSS7.1AI score0.00602EPSS
SaveExploits0Affected Software2
Rows per page
Query Builder