CVE-2026-65168

A flaw was found in Slurm. A heap-based buffer overflow exists in the socket handling code of the slurmstepd service. A local attacker with low privileges could exploit this vulnerability by sending crafted data to the service socket, corrupting memory. This could allow the attacker to achieve...

CVE-2026-121548

A flaw was found in nnn. The togglex plugin fails to properly sanitize filenames before passing them to a system command. A local attacker can exploit this flaw by placing a file with a specially crafted name in a directory, leading to arbitrary command execution with the privileges of the user...

CVE-2026-57154

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

CVE-2026-39379

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately...

EUVD-2026-116141

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately...

CVE-2026-44267

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...

CVE-2026-44266

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...

CVE-2026-44265

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax...

CVE-2026-121627

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry. Attackers can submit a URL containing a double quote and event handler through the...

CVE-2026-57154

The OPNsense firewall and routing platform is vulnerable to a configuration line injection vulnerability in versions prior to 26.1.11 and 26.4.1p1 . Authenticated users with delegated access can submit CR or LF characters in specific GUI text fields, such as those for OpenVPN, DHCPv6, Unbound, IP...

CVE-2026-57154 OPNsense: Configuration line injection via multiple GUI text fields

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — defaultFormats.elo.parse, the bin/elo CLI, or the live browser playground at elo-lang.org/try — can execute arbitrary code in the host JavaScript runtime. A payload built from the...

CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...

EUVD-2026-116111

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...

CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, plain Elo strings supplied to defaultFormats.elo.parse, bin/elo, or elo-lang.org/try can use .constructor.constructor to reach JavaScript Function because the memberaccess handler in src/transform.ts does not reject...

CVE-2026-44267

The Elo expression language for no-code tools is vulnerable to code execution prior to version 1.0.1 . Attackers can use .constructor.constructor in plain Elo strings supplied to defaultFormats.elo.parse(), bin/elo, or elo-lang.org/try to access the JavaScript Function constructor. This occurs be...

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the character. Because begins Ruby's interpolation sequences — expr, @ivar, @@cvar, $gvar — and any expression wrapped in ... may use backticks for shell execution, an Elo program that...

EUVD-2026-116110

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...

CVE-2026-44266

The Elo expression language (versions prior to 1.0.1 ) contains a vulnerability in its Ruby backend (src/compilers/ruby.ts). The issue arises because attacker-controlled text is embedded into Ruby double-quoted strings without escaping the # character. This allows Ruby interpolation forms in the ...

CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping , so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint...