59898 matches found
CVE-2026-86124 AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining acces...
SUSE CVE-2026-80759
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...
CVE-2026-86185: Improper Certificate Validation
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...
CVE-2026-86124: Missing Authentication for Critical Function
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining acces...
CVE-2026-86177: Missing Authorization
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...
PT-2026-86401
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...
CVE-2026-80759
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...
CVE-2026-80759 Bluetooth: hci_aml: validate firmware segment lengths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciaml: validate firmware segment lengths amldownloadfirmware reads two lengths from the firmware header and uses them to build pointers before checking that the header and segment data are present. A truncated or...
CVE-2026-80759
CVE-2026-80759 affects the Linux kernel's Bluetooth HCI AML driver . The function aml_download_firmware() reads two lengths from the firmware header and uses them to build pointers before verifying that the header and segment data are actually present. A truncated or inconsistent firmware image c...
CVE-2026-85610 OpenPanel before 2.3.0 Remote Code Execution via chart formulas
OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...
EUVD-2026-70812
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...
CVE-2026-17499: Improper Neutralization of Special Elements used in an OS Command
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
PT-2026-86267
PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...
CVE-2026-85623: Improper Control of Generation of Code
goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute malicious recipes that execute shell commands as the user running goose, bypassing the recipe security scan which does not inspect extensions or retry...
CVE-2026-85428
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...
CVE-2026-85428
MOOS core-moos through 10.4.0 contains an authentication bypass in its optional MOOSDB HTTP server . Unauthenticated clients can send HTTP requests with variable names and values to the MOOSDB HTTP server port, allowing them to modify MOOS variables including actuator and override commands withou...
CVE-2026-85428 MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables includin...
CVE-2026-80253
An improper physical access control issue exists in ShizenBox2 dev-conf. If exploited, an attacker with physical access to the product may execute bootloader commands without authentication...
CVE-2026-80253
CVE-2026-80253 is an improper physical access control flaw in ShizenBox2 (dev-conf) . An attacker with physical access to the device can execute bootloader commands without authentication , leading to high impact on confidentiality, integrity, and availability. The vulnerability is rated 6.8 (Med...