303448 matches found
...[ More ]
This Metasploit module exploits an unauthenticated command execution vulnerability in MCPJam Inspector. The /api/mcp/connect endpoint accepts a JSON serverConfig object containing a command and argument list used to start an MCP server. A remote attacker can abuse this endpoint to execute arbitra...
Metabase 0.61.0 Remote Code Execution
Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned by native H2 queries in result columns of type OTHER without validation. An authenticated user with permission to execute native queries against an accessible H2...
PT-2026-85071
Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...
PT-2026-84956
SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges...
FreePBX 17.0.2 - Remote Code Execution (RCE)
Exploit Title: FreePBX 17.0.2 - Remote Code Execution Date: 2026-08-12 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.freepbx.org/ Software Link: https://github.com/FreePBX/freepbx Version: FreePBX 15.x 15.0.66, 16.x 16.0.89, 17.x 17.0.3 Tested on: Linux Debian/Ubuntu with...
Linux Distros Unpatched Vulnerability : CVE-2026-84361
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an...
Linux Distros Unpatched Vulnerability : CVE-2026-84838
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress...
Linux Distros Unpatched Vulnerability : CVE-2026-84372
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster an...
CVE-2026-18718 — Updated!
Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...
EUVD-2026-58544
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods...
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...
GHSA-2MW5-23GM-PCCQ OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...
EUVD-2026-58507
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints...
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...
GHSA-52GF-6RPQ-FGMX OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Summary The OpenChoreo API server openchoreo-api authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the...
EUVD-2026-63663
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection...
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...
GHSA-W878-PJ84-3J5V Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Summary Mailpit's SMTP server reads each command line with an unbounded bufio.Reader.ReadString'\n' before parsing the command or enforcing any protocol length limit. A remote SMTP client can send an oversized single command line and force Mailpit to allocate attacker-controlled memory before the...
GHSA-9468-V6MJ-FPPW Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Vulnerability Details File: internal/client/handler.go OnClientConnecting, internal/proxy/http.go requestHeaders, internal/proxy/grpc.go requestMetadata, internal/unigrpc/grpc.go Consume Line: handler.go:389,548-552 e.Headers - SetEmulatedHeadersToContext, http.go:131-165 requestHeaders,...
