472695 matches found
EUVD-2026-63482
NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which...
CVE-2026-18264
NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which...
CVE-2026-54449
In LangBot 4.10.7 and earlier, StdioServerParameters in src/langbot/pkg/provider/tools/loaders/mcp.py runs attacker-supplied commands as a server-side subprocess without authorization checks (CWE-78). Any authenticated user can add an arbitrary command via the Extensions MCP tab, achieving full R...
form-data: form-data: Form field override via CRLF injection
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return CR, line feed LF, or double-quote " characters into the field argument of FormDataappend or the filename option. This allows th...
Important: Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update
An update for rh-podman-desktop is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2026-77004 Comfast CF-N1-S mbox-config sprintf command injection
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...
CVE-2026-77004
Comfast CF-N1-S firmware 2.6.0.1 exposes a command injection flaw in the sprintf function at /cgi-bin/mbox-config?method=SET§ion=ptest_sn. Remote attackers with low privileges can manipulate the sn argument to execute arbitrary commands; a proof-of-concept exploit has been published. No patch...
EUVD-2026-63479
A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET§ion=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...
CVE-2026-63039 Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...
EUVD-2026-63400
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...
CVE-2026-63038
Apache InLong versions 2.0.0 to before 2.4.0 are vulnerable to SQL injection via the dbName, tableName, schemaName, and username parameters, which are concatenated into SQL queries without sanitization. Attackers can inject arbitrary SQL, potentially compromising data integrity or availability. U...
CVE-2026-63038 Apache InLong: SQL Injection via String Concatenation Vulnerability Report
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...
EUVD-2026-63399
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters. This issue affects Apache InLong: from 2.0.0 before 2.4.0...
Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.
Summary IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries. Vulnerability Details CVEID:CVE-2026-50020 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and...
CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...
EUVD-2026-63398
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...
EUVD-2026-63395
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=deletecategory. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack...
CVE-2026-76998 SourceCodester Simple Online Food Ordering System ajax.php delete_category sql injection
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=deletecategory. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack...
CVE-2026-76998
A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=deletecategory. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack...
