829 matches found
Shopify: mruby-engine: UAF in MRubyEngine#initialize enables local RCE
Summary Double-init of MRubyEngine frees engine + unmaps mspace, but leaves Ruby DATAPTR dangling. Kernel reuses freed VA via mmapMAPFIXED. Attacker forges memrubyengine struct + mrbstate in reclaimed region, points mrbstate-allocf at libc.system, arranges bytes of mrbstate to also spell a shell...
PT-2026-33382
Name of the Vulnerable Software and Affected Versions home-assistant-cli versions prior to 1.0.0 Description The Home Assistant Command-line interface hass-cli used an unrestricted environment instead of a sandboxed one to handle Jinja2 templates. User-supplied input within these templates was...
CVE-2026-32190
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...
EUVD-2026-22633
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...
EUVD-2026-22569
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...
EUVD-2026-22571
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...
EUVD-2026-22534
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally...
CVE-2026-33095
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...
PT-2026-32723
CVE-2026-23657 | Microsoft 365 Apps for Enterprise | Remote Code Execution Description A use-after-free vulnerability in Microsoft Office Word in Microsoft 365 Apps for Enterprise allows an unauth attacker to achieve local RCE by tricking a user into opening a malicious document that triggers...
cmd/go: cmd/go: Local code execution and arbitrary file write via malicious module version strings
A flaw was found in Golang's cmd/go module. This vulnerability allows a local attacker to achieve local code execution by downloading and building modules with specially crafted malicious version strings. On systems with Mercurial hg installed, this can occur when downloading modules from...
binutils: GNU Binutils Linker heap-based overflow
A head based buffer overflow flaw has been discovered in GNU bin utilities. Impacted is the function bfdelfparseehframe of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution...
EUVD-2019-20075
River Past Video Cleaner 7.6.3 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lameenc.dll field. Attackers can craft a payload with 280 bytes of padding, a next structured exception...
CVE-2019-25681 Xlight FTP Server 3.9.1 SEH Overwrite Buffer Overflow
Xlight FTP Server 3.9.1 contains a structured exception handler SEH overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual...
CVE-2026-5455
A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the component ca.diagram.dialogue. Executing a manipulation of the argument SEGMENTWRITEKEY can lead to use of hard-coded cryptographic key...
CVE-2026-5455 Dialogue App ca.diagram.dialogue config.json hard-coded key
A vulnerability was determined in Dialogue App up to 4.3.2 on Android. The affected element is an unknown function of the file file res/raw/config.json of the component ca.diagram.dialogue. Executing a manipulation of the argument SEGMENTWRITEKEY can lead to use of hard-coded cryptographic key...
CVE-2026-5455
CVE-2026-5455 affects Dialogue App up to version 4.3.2 on Android. The vulnerable element is an unknown function in file res/raw/config.json of the ca.diagram.dialogue component. Manipulation of the argument SEGMENT_WRITE_KEY can lead to use of a hard-coded cryptographic key. The attack is local-...
Act 注入漏洞
Act is a locally run tool developed by Nektos and open source. Versions of Act prior to 0.2.86 had an injection vulnerability. This vulnerability stemmed from unconditionally processing the::set-env:: and::add-path:: workflow commands, which could lead to setting arbitrary environment variables o...
CVE-2026-5037
A vulnerability was determined in mxml up to 4.0.4. This issue affects the function indexsort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit ha...
CVE-2026-5037
A vulnerability was determined in mxml up to 4.0.4. This issue affects the function indexsort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit ha...