494544 matches found
CVE-2026-78463
Improper control of generation of code 'code injection' in Remote Desktop Client allows an unauthorized attacker to execute code over a network...
CVE-2026-77908
Improper control of generation of code 'code injection' in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...
CVE-2026-76191
Animate is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requir...
CVE-2026-69716
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-69636
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
CVE-2026-69534
Improper neutralization of special elements used in a command 'command injection' in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally...
CVE-2026-67370
Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-66820
Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-66819
Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...
CVE-2026-65669
Improper neutralization of special elements in output used by a downstream component 'injection' in SQL Server allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-82537 Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word...
EUVD-2026-74040
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line wit...
CVE-2026-82536
Roo-Code through version 3.54.0 contains an auto-approve bypass in its shell command parsing logic. The root cause is the omission of the bash pipe operator (specifically the stderr-redirecting pipe) from the parser's operator token set. An attacker can craft a command line combining an allowlist...
CVE-2026-76201 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...
EUVD-2026-74036
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...
CVE-2026-76200 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...
CVE-2026-76200
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An unauthenticated attacker can inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they visit the affected page. This may allow the attacker to gain elevated a...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
GHSA-5QR2-V392-M9G8 SWC HTML minifier may allow script element breakout when minifying embedded JSON
Impact @swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal sequence, the generated HTML...