GHSA-63GH-G2X5-X69V Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.DiaSymReader.Native. This advisory also provides guidance on what...

POC-CVE-2025-24813

CVE-2025-24813 – Ambiente de Demostración PoC Este repositorio contiene una aplicación simple construida para observar el comportamiento del CVE-2025-24813, una vulnerabilidad reciente en Apache Tomcat relacionada con el uso del DefaultServlet con escritura habilitada readonly=false, permitiendo...

CVE-2026-86739

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-67434

A flaw was found in PHPCodeSniffer. This command injection vulnerability allows an attacker to execute arbitrary shell commands. This occurs when PHPCodeSniffer processes untrusted files with specially crafted filenames containing shell metacharacters, specifically when generating Gitblame,...

EUVD-2026-74917

Snipe-IT before 8.7.0 fails to check the return value of Storage::delete in UploadedFilesController::destroy and Api\UploadedFilesController::destroy, allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses...

EUVD-2026-74916

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store. On filesystem drivers that return false instead of throwing on a write failure for example the local disk with restricti...

CVE-2026-86739

Snipe-IT versions 8.6.3 and earlier contain a defect in Account\AcceptanceController::store() where the return value of Storage::put() is not checked when writing the signature PNG and generated acceptance PDF . On filesystem drivers that silently return false on write failure (e.g., restrictive ...

DEBIAN-CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-87817

GitPython before 3.1.60 is vulnerable to remote code execution via git directory impersonation . The library fails to properly validate the git directory location, allowing an attacker to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. The attack executes ar...

EUVD-2026-74843

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-86547

mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the openter handler in src/vm.c when processing untrusted bytecode. Attackers can craft malicious .mrb bytecode files with OPENTER instructions at the top level to crash the embedding application and cause denial of service...

CVE-2026-87747

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

CVE-2026-57825

A flaw was found in the opam package manager for OCaml. This vulnerability allows a malicious package to bypass the sandbox protection mechanism. By mishandling symlinks during the processing of .install files, an attacker can write arbitrary files to unintended locations on the system, potential...

CVE-2026-87747 Ragic｜Enterprise Cloud Database - Arbitrary File Read

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

CVE-2026-87747

Ragic Enterprise Cloud Database is affected by an Arbitrary File Read vulnerability caused by Relative Path Traversal . Privileged remote attackers can exploit this flaw to download arbitrary system files, resulting in high confidentiality impact with no integrity or availability impact. The CVSS...

CVE-2026-21092

CVE-2026-21092 is a path traversal vulnerability in the ImsService component of Samsung mobile devices, affecting versions prior to SMR Sep-2026 Release 1 . The flaw allows remote attackers to create image files with system server privilege , potentially compromising system integrity. The assigne...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

CVE-2026-57825

In opam (OCaml package manager) versions before 2.5.2 , the sandbox protection mechanism can be bypassed due to mishandled symlinks during .install file processing. Specifically, installing files through .install files did not check symlink resolution on the target path, allowing a package to ins...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...