GHSA-C83V-7274-4VGP Malicious website can execute commands on the local system through XSS in the OpenCode web UI

Summary A malicious website can abuse the server URL override feature of the OpenCode web UI to achieve cross-site scripting on http://localhost:4096. From there, it is possible to run arbitrary commands on the local system using the /pty/ endpoints provided by the OpenCode API. Code execution vi...

CVE-2026-21219

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2026-21219

Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally...

CVE-2026-20953

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-20957

Integer underflow wrap or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20953

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-20956

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20956

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20957

Integer underflow wrap or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20955

Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20950

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20948

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-20946

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20950

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20952

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-20946

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-20952

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-20948

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-20951

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally...

CVE-2026-20943

Untrusted search path in Microsoft Office allows an unauthorized attacker to execute code locally...