CVE-2026-93209

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: use skbget instead of skbclone for reqskb BT enable fails intermittently with -ETIMEDOUT -110. The kernel log shows the HCI Read Local Version command was sent and the firmware replied with status 0x00 logged ...

CVE-2026-93243

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMITMEMLOCK limit. However the folios are unevictable and remain so until the inode is...

CVE-2026-96751: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

CVE-2026-95519: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-87118: Out-of-bounds Write

The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the...

CVE-2026-93243: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: properly account locked pages secretmem accounts folios by treating memory as if it were mlock'd and thus limited by the RLIMITMEMLOCK limit. However the folios are unevictable and remain so until the inode is...

CVE-2026-89325: Uncontrolled Search Path Element

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check...

CVE-2026-96745: Deserialization of Untrusted Data

Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data...

CVE-2026-95521: Improper Neutralization of Special Elements used in an OS Command

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a % macro construct causes rpm to execute an attacker-controlled shell command via popen while relocating the source file list. This allows arbitrary command execution as t...

CVE-2026-97366: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

CVE-2026-82370

Brocade SANnav versions before 3.0.1a are vulnerable to an unauthenticated remote command injection in the orchestrator HTTP service. This flaw allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. Potential impacts ...

CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service

Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch...

CVE-2025-55182-Metasploit-exploit-skeleton-real-flow-

🧪 PASO 1: Aplicación web vulnerable de demostración LAB Creamos una lógica similar a CVE-2025-55182 ejecución insegura en el lado del servidor. 📁 vulnapp/app.py root@kitploit: from flask import Flask, request import subprocess app = Flaskname @app.route"/render", methods="POST" def render: data =...

Exploit for CVE-2026-95675

CVE-2026-95675 - D-Link DAP-1360 !https://threataft.com/im...

CVE-2026-82090-18-Years-All-Versions-CVSS-9.2-CRITICAL-The-Pocket-Forever-Day

Informe de vulnerabilidad XSS 0-Click / 0-Day Cross-Site Scripting 0-Click que conduce al abuso del puente JavaScript en Pocket Android e iOS — CVSS 9.2 CRÍTICO CVE-2026-82090 — Publicado por MITRE Corporation 2026-08-28 Autor: Ing. Zampier Zago FUNFACTOR1 División: Sección 1 — Departamento de...

CVE-2026-81537

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...

automation-controller: automation-controller-container: automation-controller: Project scm_url argument injection into `git ls-remote --upload-pack` yields RCE on the controller-task control-plane pod

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

automation-controller: automation-controller-container: automation-controller: host_filter SmartFilter ORM traversal exposes JobEvent/AdHocCommandEvent event_data and stdout to users without permission on the job, enabling blind character-by-character extraction of job output (cross-tenant information disclosure)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The hostfilter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relatio...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...