CVE-2026-59914

Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...

CVE-2026-59917

Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...

CVE-2026-59916

Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...

CVE-2026-46731

Dell Display and Peripheral Manager DDPM Windows, versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution...

CVE-2026-19656

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user including one holding only low-privilege, read-only permissions to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the conte...

CVE-2026-17417

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters...

CVE-2026-17642

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-17083

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

CVE-2026-67579

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

EEF-CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash

Summary Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination deco...

CVE-2026-67579

The CVE affects ash-project ash (Ash) and describes a Deserialization of Untrusted Data vulnerability: an unauthenticated attacker can inject a filter expression through a forged keyset pagination cursor. The reader decodes page[:after]/page[:before] with non_executable_binary_to_term/2, allowing...

CVE-2026-63294

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...

CVE-2026-63294

CVE-2026-63294 concerns LXD, where during import/unpack of crafted image or backup archives, a symlinked backup.yaml file is not properly confined. This allows processing of unconfined configuration metadata and could enable root command execution on the host. The issue is tied to how LXD handles...

CVE-2026-73415

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...

CVE-2026-73415 jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...

EUVD-2026-57535

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...

CVE-2026-73415

Summary : In JupyterLab, the ImageViewer (packages/imageviewer/src/widget.ts) uses URL.createObjectURL for a crafted SVG image and revokes the blob URL too early, allowing a cross-site scripting context that can execute arbitrary code on the JupyterLab server when opened from the viewer and then ...

CVE-2026-13361

IBM Informix oninit sqsgkprepare RCE via unchecked SQL Interface length field...

CVE-2026-17642

CVE-2026-17642 affects IBM i releases 7.3–7.6 in the Resource Monitoring and Control (RMC) component. It allows a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command (OS Command Injection, CWE-78). The IBM bulletin l...