CVE-2026-84153

A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavevalue&ajaxbool=true. Executing a manipulation of the argument Value can lead to sql injection. The attack may be performed from remote. The...

CVE-2026-79682

Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58567

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

cacti-rce-snmp-options-vulnerable-application

Cacti v1.2.24 认证命令注入（CVE-2023-39362）漏洞应用程序 这是一个用于测试 Cacti 漏洞（CVE-2023-39362 ）攻击程序的漏洞应用程序。 警告！ 此应用程序包含严重的安全漏洞。运行风险自负！建议使用经过备份且隔离的环境（例如具有近期快照和仅主机网络（host-only networking）的虚拟机）。请勿将此应用程序上传到任何面向互联网的服务器，否则它们将被入侵。 免责声明 : 我对任何人使用此应用程序的方式不承担任何责任。此应用程序的唯一用途是作为 CVE-2023-39362...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

CVE-2026-83618

A flaw was found in xmldom, a JavaScript XML parser and serializer module. A remote attacker could bypass the requireWellFormed strict-serialization mitigation for DocumentType injection by embedding line terminators within the publicId or systemId of a DocumentType declaration. This allows for t...

CVE-2026-83616

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. An attacker can exploit a vulnerability in how processing instructions are handled to inject arbitrary XML structures. This occurs because the software fails to properly validate input, allowing special characters to...

CVE-2026-58567

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-58567

Dell PowerStore is affected by an OS Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, changed scope...

EUVD-2026-69302

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-83610

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. The Document.createEntityReference function incorrectly accepts invalid names, which are then directly emitted during serialization. This vulnerability allows an attacker to inject arbitrary XML fragments when an...

CVE-2026-83608

A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. A remote attacker can exploit this vulnerability by providing a specially crafted DocumentType.name containing characters like or whitespace. This bypasses the requireWellFormed validation, allowing the injection of...

CVE-2026-83605

A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into...

CVE-2026-79682

Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

EUVD-2026-69299

Dell PowerStore contains a Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges...

CVE-2026-79682

Dell PowerStore is affected by a Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) with a local attack vector, low complexity, and changed scope, resulting in high impact ...

CVE-2026-84232 Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type e.g., text/html for .html files, image/svg+xml for .svg files and without a Content-Disposition: attachment header when using local filesystem...

AZL-99369 CVE-2026-84233 affecting package rpm 4.18.2-1

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...