366681 matches found
EUVD-2026-57695
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every element in the document head through pdfwebkitmetatags and turns each one into a wkhtmltopdf command line...
EUVD-2026-57696
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...
Exploit for CVE-2026-14282
CVE-2026-14282 — GoDAM WordPress Plugin RCE Author: null...
CVE-2026-16770
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every element in the document head through pdfwebkitmetatags and turns each one into a wkhtmltopdf command line...
CVE-2026-17431
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...
hyperlight-overlaybd-poc
hyperlight-overlaybd-poc Can the output of a sandboxed job...
CVE-2026-49481
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...
CVE-2026-17431
PDF::WebKit for Perl (versions through 1.2) contains an OS command injection flaw. The vulnerability stems from two-argument open() usage on the output path in to_pdf and on stylesheet paths in _style_tag_for; untrusted input can be treated as commands (e.g., starting with |) or redirects (>),...
CVE-2026-17431
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...
CVE-2026-16770 PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every element in the document head through pdfwebkitmetatags and turns each one into a wkhtmltopdf command line...
CVE-2026-16770
PDF::WebKit for Perl versions up to 1.2 allows argument injection into wkhtmltopdf via HTML meta tags. The constructor collects , normalizes KEY to --[a-z0-9-]+, and turns each into a wkhtmltopdf option; VALUE is passed as the argument, with VALUE=Yes producing a bare flag. BUILD merges these met...
CVE-2026-16770
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every element in the document head through pdfwebkitmetatags and turns each one into a wkhtmltopdf command line...
EUVD-2026-57694
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-49481
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-49481 UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd
UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...
CVE-2026-49481
UpSnap (wake on LAN web app) before version 5.4.0 is affected by an authenticated OS command injection in device management. User-controlled ip/mac values can be interpolated into wake_cmd/shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sanitization, enablin...
CVE-2026-73501
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...
CVE-2026-73501
kin-openapi vulnerability CVE-2026-73501: prior to v0.144.0, ValidationHandler.Load() silently replaced a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil and does not verify credentials. This leads to every OpenAPI security requirement being satisfied for unauthenticated req...
CVE-2026-73501 kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load in openapi3filter/validationhandler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI...