CVE-2026-47252: Improper Control of Generation of Code

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

CLSA-2026-1789602943 vim: Fix of CVE-2026-73077

CVE-2026-73077: pass the K keyword argument to zsh run-help as a separate list item so shell metacharacters in the selected text cannot execute commands...

CVE-2026-76424

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a...

CVE-2026-20283

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762

Pelican Panel versions before 1.0.0-beta35 contain an authorization bypass in the Startup page component. Write permissions are enforced only through disabled form controls (client-side) rather than server-side checks, meaning an attacker with the low-level startup.read permission can craft Livew...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

EUVD-2026-81030

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-20324

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions t...

CVE-2026-20283 Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

CVE-2026-20283 Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

CVE-2026-20283

A command injection vulnerability in the IPsec Open API endpoint of Cisco Identity Services Engine (ISE) allows an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The root cause is insufficient validation of user-supplied input in IPsec Open API ca...

CVE-2026-76424 Cisco ISE Arbitrary File Access Vulnerability

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a...

EUVD-2026-81131

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a...

CVE-2026-20340 Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by...

CVE-2026-20340 Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by...

EUVD-2026-81116

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by...

CVE-2026-20340

Cisco Secure Firewall Management Center (FMC) Software is affected by an unsecured deserialization vulnerability in web-management user-controlled data. An authenticated remote attacker with at least the Security Analyst (read-only) role can send a crafted HTTP payload to the device, save it, and...