CVE-2026-66149

The SonicWall Email Security appliance (including ES Appliance 5000, 5050, 7000, 7050, 9000, VMWare, and Hyper-V) is vulnerable to a Code Injection vulnerability (CWE-94 ) in the restricted CLI . An authenticated attacker can exploit the netmask functionality, specifically the updateNetIf functio...

EUVD-2026-56946

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...

CVE-2026-66149

Improper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask...

CVE-2026-73233

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a...

CVE-2026-73233

FreeCAD CVE-2026-73233 affects the FEM Displacement Constraint dialog prior to version 1.1.2. The escaping helper fails to neutralize backslashes, letting crafted x/y/zDisplacementFormula text terminate the generated Python string and execute arbitrary Python code with the FreeCAD process privile...

EUVD-2026-56920

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in...

CVE-2026-73083

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

CVE-2026-70338

Improper control of generation of code 'code injection' in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-70336

Improper control of generation of code 'code injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-70338

Improper control of generation of code 'code injection' in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-70336

Improper control of generation of code 'code injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

CVE-2026-65660

Improper control of generation of code 'code injection' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

EUVD-2026-56767

Improper control of generation of code 'code injection' in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-70338

Improper control of generation of code 'code injection' in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally...

EUVD-2026-56589

Improper control of generation of code 'code injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...

EUVD-2026-56431

Improper control of generation of code 'code injection' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Malicious Package

Overview dakumangalsinghvirus is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-56551

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

Malicious Package

Overview tilaver-mfa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

CVE-2026-60122

A flaw was found in gpsd. This code injection vulnerability in the gpsprof utility allows an attacker to execute arbitrary operating system OS commands. By controlling GPS input data, an attacker can inject malicious content into the SKY.satellites.used field. This unsanitized input is then...