56283 matches found
PT-2026-106715
Name of the Vulnerable Software and Affected Versions Smarty versions prior to 4.5.8 Smarty versions 5.x prior to 5.8.5 Description A code injection flaw exists during multi-component template inheritance where the top-level nocache hash is not restored and remains null. This allows an attacker t...
PT-2026-106930
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in the HTML component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after...
PT-2026-107093
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in the PDF component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after...
RHEL 7 : firefox (RHSA-2026:76741)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:76741 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...
CVE-2024-27956
CVE-2024-27956 CVE-2024-27956...
CVE-2026-82329
CVE-2026-82329 Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha...
EUVD-2026-91749
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling...
EUVD-2026-26838
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution...
CVE-2026-105697
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...
CVE-2026-100818
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component...
CVE-2026-103622
An use after free flaw was found in the SVG component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/565742179...
CVE-2026-100791
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...
CVE-2026-105697
Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...
CVE-2026-100778
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component...
e-cology
Weaver e-cology OA Beanshell Component Remote Code Execution Windows Linux Notes Detect the target system's os.name if the target system is Windows, executing commands such as set requires manually typing cmd.exe /c set Use Unicode to bypass the exec filter on some sites. Payload...
CVE-2023-49987
CVE-2023-49987 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "tname" parameter on "newterm" Description : A cross-site scripting XSS vulnerability in the component “newterm” of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or...
CVE-2016-2386
CVE-2016-2386 SAP NetWeaver AS JAVA UDDI Component SQL Injection POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Content-Type:...