9625 matches found
CVE-2026-51302
SQLite 3.41 contains a use-after-free in the expression evaluation logic: sqlite3ReleaseTempReg frees temporary registers, but exprComputeOperands may access freed memory. This could allow a remote attacker to cause DoS, leak data, or potentially execute arbitrary code. The connected docs do not ...
📄 vBulletin 6.2.1 Remote Code Execution
vBulletin version 6.2.1 and prior 6.x versions, along with version 5.7.5 and prior 5.x versions, contain a pre-authentication remote code execution vulnerability in the vB5TemplateRuntime::runMaths method. Insufficient input validation allows a crafted vb:math expression to bypass the regular...
CVE-2026-51302
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51300
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
EUVD-2026-49354
A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to release an expression object, the program still retains the dangling pointer and subsequently accesses member fields of the already freed memory. By...
Siemens SIMATIC S7-1500 CPU 1518 MFP Missing Default Case in Multiple Condition Expression (CVE-2025-39748)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505685; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...
CVE-2026-51300
SQLite 3.41 contains a use-after-free vulnerability in the expression parsing/memory management logic. Specifically, after sqlite3ExprDelete releases an expression object, the program may still access freed memory in expr.c, allowing a remote attacker to craft malicious SQL queries that trigger i...
CVE-2026-63720
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
CVE-2026-63720
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
PT-2026-64984
Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description A use-after-free flaw exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temporary register resources, which the exprComputeOperands function subsequently accesses....
PT-2026-64983
Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description An issue exists in the expression parsing and memory management logic. After the sqlite3ExprDelete function is called to release an expression object, the program retains a dangling pointer and accesses member...
sqlite: SQLite: Arbitrary code execution via malicious SQL statement
A flaw was found in SQLite. A use-after-free vulnerability in the expression evaluation logic, specifically within the sqlite3ReleaseTempReg and exprComputeOperands functions, allows a remote attacker to exploit the system. By supplying a malicious SQL statement, an attacker can cause a denial of...
K000162436: Spring Web Flow vulnerability CVE-2026-40985
Security Advisory Description Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1. CVE-2026-40985 Impact There is no impact; F5 products are not...
CVE-2026-65693 Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates
Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render,...
CVE-2026-15243
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...
CVE-2026-15243
The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...
n8n - Remote Code Execution via Expression Injection
n8n 1.120.4, 1.121.1, 1.122.0 contains a remote code execution caused by insufficient isolation in workflow expression evaluation, letting authenticated attackers execute arbitrary code with n8n process privileges. Exploit requires authentication. id: CVE-2025-68613 info: name: n8n - Remote Code...
GHSA-652Q-GVQ3-74QV n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...