2136 matches found
Jan v0.4.12 - Arbitrary File Upload
An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-36858 info: name: Jan v0.4.12 - Arbitrary File Upload author: pussycat0x severity: critical description: | An arbitrar...
PT-2026-115484
Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers versions prior to 3.7.5 Description An issue exists where unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted input...
Astra Linux – Vulnerability in Firefox
Insufficient validation in the Drag and Drop API, combined with social engineering, may have allowed an attacker to trick end-users into creating shortcuts to local system files. This could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions earlier than 115...
PT-2026-114984
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root...
CVE-2026-102870
The Blazor WebAssembly debug proxy embeds attacker-controlled ToString, description, and class-name values into generated C without consistently escaping them. When a developer evaluates an expression while debugging, the value can escape the generated string literal and execute code on the...
CVE-2026-69370
Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
CVE-2026-100207
Improper neutralization of special elements used in an os command 'os command injection' in Azure CycleCloud allows an authorized attacker to execute code locally...
EUVD-2026-99596
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
WordPress Post Export Import with Media: Deserialization Injection Vulnerability
WordPress Post Export Import with Media has a deserialization injection vulnerability in versions 1.17.1 and earlier. This vulnerability stems from the deserialization processing of untrusted inputs, leading to PHP object injection. Certified attackers with administrator or higher privileges may ...
EUVD-2026-95260
System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to...
PT-2026-96645
Name of the Vulnerable Software and Affected Versions Give Tributes versions prior to 2.3.2 Description The Give Tributes plugin for WordPress is susceptible to PHP Object Injection through the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. The...
Astra Linux – Vulnerability in PostgresSQL 11
schemaelement defeats protective measures for search paths; It was discovered that certain database calls in PostgreSQL could allow an authenticated attacker with elevated database-level privileges to execute arbitrary code...
CVE-2026-70336
Improper control of generation of code 'code injection' in Visual Studio Code allows an unauthorized attacker to execute code over a network...
Malicious code in dolyame-ui-inputtime (npm)
Source: amazon-inspector 19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5 On require'dolyame-ui-inputtime', index.js loads./loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts oob-worker.cf101-.workers.dev, oob-worker.cf102-.workers.dev,...
MAL-2026-12174 Malicious code in cors-update (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin...
EUVD-2026-52535
Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...
EUVD-2026-52524
Buffer over-read in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...
CVE-2026-66312
Buffer over-read in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...
PT-2026-67569
Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Missing authorization in the software allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newe...