Rocket.Chat v8.7.0-rc.6

The ultimate secure open-source solution for team communications Rocket.Chat is an open-source, secure, fully customizable communications platform developed in TypeScript for organizations with high standards of data protection. We are the ultimate solution for team communications, enabling...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update

Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image. Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal as a bootable...

CVE-2026-53985

CVE-2026-53985 affects Ground Station prior to version 0.6.0. It describes an unauthenticated denial-of-service in the Socket.IO server’s service_control event handler, allowing an unauthenticated network peer to forcibly terminate the ground-station process by sending a restart_service command. ...

CVE-2026-53975

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

EUVD-2026-53932

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

exploit-code-db

README This README would normally document whatever steps a...

CVE-2025-14779 Improper Access Control via Secret Type Management API in WSO2 Identity Server

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation o...

CVE-2026-68746

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

EEF-CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Summary Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

EUVD-2026-53601

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297

CVE-2026-66297 is an OS command injection in Livebook where deployment group environment variables are interpolated into Docker and Fly.io setup commands without shell escaping. The vulnerability arises in LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent (docker_instructions/2, fly_instruction...

CVE-2026-68746 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

CVE-2026-68746 Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...