607897 matches found
CVE-2026-73330
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...
EUVD-2026-57431
CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the testemail settings action, which are evaluated when an SMTP rejection reflects the recipient address...
CVE-2026-73299
Prompty is a markdown file format .prompty for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype propertie...
CVE-2026-73327
Joomla 6.1.1 contains a path traversal vulnerability in the comjoomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...
CVE-2026-18669
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority...
CVE-2026-18235
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation...
CVE-2026-16956
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-17218
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write...
CVE-2026-17110
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management...
CVE-2026-16907
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...
CVE-2026-16904
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment...
CVE-2026-16860
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element...
CVE-2026-73327 Joomla 6.1.1 Zip Slip Path Traversal via com_joomlaupdate extract.php
Joomla 6.1.1 contains a path traversal vulnerability in the comjoomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...
CVE-2026-73327
CVE-2026-73327 affects Joomla 6.1.1 through the com_joomlaupdate extension. A path traversal vulnerability arises during archive extraction: an attacker can supply ZIP entry names containing directory traversals (or absolute paths) to the extract.php routine, causing files to be written outside t...
EUVD-2026-57390
Joomla 6.1.1 contains a path traversal vulnerability in the comjoomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...
CVE-2026-16907
IBM i bulletin CVE-2026-16907 affects IBM i 7.3–7.6 (5770-SS1) and describes a remote authenticated code execution vulnerability in the Debug Server caused by improper bounds checking. Affected releases: 7.6, 7.5, 7.4, and 7.3. Impact per the CVSS: Confidentiality Low, Integrity High, Availabilit...
EUVD-2026-57387
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking...
CVE-2026-17218
CVE-2026-17218 affects IBM i (Line Printer Daemon, LPD) across releases 7.3–7.6. An out-of-bounds write could allow a remote attacker to execute arbitrary code. The IBM bulletin confirms a CVSS v3.1 base score of 9.8 (Network, high impact) and lists affected products/versions along with fixed pat...