TrueConf Server < 5.3.9.10013 / 5.4.9.10018 / 5.5.5.10010 Multiple Vulnerabilities

The version of TrueConf Server installed on the remote host is prior to 5.3.9.10013, 5.4.9.10018, or 5.5.5.10010. It is, therefore, affected by multiple vulnerabilities: - A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function an...

PT-2026-93119

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A critical function lacks authentication, which could allow an attacker to execute commands as root by passing received bytes directly to a system command...

ROS-20260915-73-0203

The vulnerability of the epfree function in the eventpoll.c component of the Linux kernel’s operating system is related to the dereferencing of a pointer whose expiration time has passed. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2026-55690: Improper Neutralization of Input During Web Page Generation

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php interpolates an...

CVE-2026-19780: Improper Neutralization of Directives in Dynamically Evaluated Code

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

PT-2026-93169

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

ROS-20260915-73-0147

The vulnerability of the epremove function in Linux operating system kernels relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

USN-8758-1: dracut vulnerability

It was discovered that dracut did not properly shell-quote messages written by the die function to the emergency hook directory. An attacker on the adjacent network controlling a rogue DHCP server could use this issue to inject commands that execute as root during boot-failure handling...

rsync: rsync: Heap Out-of-Bounds Write via crafted argument list

A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the readargs function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code...

rsync: rsync: Denial of Service via Algorithmic Complexity

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS...

rsync: rsync: Denial of Service via Algorithmic Complexity

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS...

rsync: rsync: Heap Out-of-Bounds Write via crafted argument list

A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the readargs function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code...

CVE-2026-82035

A flaw was found in PyMuPDF. This path traversal vulnerability exists in the extractobjects function, specifically within the font branch. A remote attacker can exploit this by providing a specially crafted PDF, EPUB, XPS, or FB2 file. The vulnerability allows the attacker to use encoded path...

CVE-2026-54182

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...

CVE-2026-90809

HKUDS nanobot (versions up to 0.2.1) is affected by an argument injection vulnerability in the ExecTool component, specifically in the ExecTool._guard_command and ExecTool._spawn functions within nanobot/agent/tools/shell.py. The flaw allows a remote attacker with no privileges or user interactio...

CVE-2026-54182 backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...

EUVD-2026-77707

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...

CVE-2026-55091 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

CVE-2026-55091 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

CVE-2026-55091 flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...