143 matches found
CVE-2026-73678-PoC
CVE-2026-73678 — MindsDB Minds Platform: неаутентифицированное удалённое выполнение кода RCE CVSS 10.0 CVSS 10.0 критический · CWE-94 / CWE-306 · GHSA-jcxw-h8ph-pxpv · VulnCheck Краткое описание Minds Platform open-source бэкенд репозитория mindsdb/mindshub, ранее mindsdb/minds-platform...
CVE-2023-22527
CVE-2023-22527 — Удалённое выполнение кода в Atlassian Confluence Обзор CVE-2023-22527 — это критическая уязвимость удалённого выполнения кода в Atlassian Confluence Data Center и Server. Данная уязвимость позволяет неаутентифицированным злоумышленникам выполнять произвольный код на уязвимых...
CVE-2025-49029
🚨 Плагин WordPress Custom Login And Signup Widget 🔥 Базовая оценка: 9.1 КРИТИЧЕСКИЙ CWE ID: CWE-94 – Некорректный контроль генерации кода 'Code Injection' 🧠 Описание Плагин позволяет администраторам изменять содержимое файла sn.php через поле Имя отправителя на странице настроек. Вводимые...
Crawl4AI <= 0.8.6 - Remote Code Execution
Crawl4AI through 0.8.6 ships a Docker API server that exposes an unauthenticated /crawl endpoint. The computed field type of JsonCssExtractionStrategy evaluates a user supplied expression inside an AST based sandbox that does not restrict attribute access on generator frame objects. A generator...
Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...
GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...
Flowise < 3.1.3 - Remote Code Execution
Flowise prior to 3.1.3 contains a remote code execution vulnerability caused by allowing authenticated users to set arbitrary TypeORM DataSource options including entities that load local JavaScript files, letting authenticated users execute arbitrary code on the server, exploit requires user...
CVE-2026-21858
CVE-2026-21858 Piattaforma di Automazione dei Workflow n8n - Esecuzione di Codice Remota Uno strumento di ricerca sulla sicurezza per il rilevamento di CVE-2026-21858, una vulnerabilità critica di esecuzione di codice remota nella piattaforma di automazione dei workflow n8n. Indice dei Contenuti...
cve-2026-33067
CVE-2026-33017 — Modello Nuclei per RCE non autenticata in Langflow Modello Nuclei che rileva CVE-2026-33017 — una vulnerabilità di esecuzione remota di codice non autenticata in Langflow ≤ 1.8.2 raggiungibile tramite l'endpoint pubblico di build dei flussi: root@kitploit: POST...
CVE-2026-76316
An unauthenticated remote attacker who can reach the Splunk management port can register a crafted Deployment Server client identifier, which is then inserted into dispatched searches without special-character sanitization. When an administrator opens the Add Data forwarder workflow, the injected...
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...
GHSA-9GMC-JQMH-3RVM Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
Copier: trust-prefix bypass via path traversal runs tasks unprompted Summary In copier = 9.5.0, = 9.15.1, the trust setting's prefix match copier/settings.py compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when th...
CVE-2026-67364
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...
CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...
CVE-2026-67364
Balbooa Forms for Joomla (versions
CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...
PT-2026-78353
Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An unauthenticated attacker can perform PHP code injection due to the use of the eval function in the optional custom-PHP post-submission handler. The URL parameter = X shortcode is replaced...
Exploit for CVE-2026-73678
CVE-2026-73678 — MindsDB Minds Platform Unauthenticated RCE C...