Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

Microsoft Office Remote Code Execution Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally...

.NET Framework Remote Code Execution Vulnerability

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally...

Microsoft Excel Remote Code Execution Vulnerability

Integer underflow wrap or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

Microsoft Office Remote Code Execution Vulnerability

Access of resource using incompatible type 'type confusion' in Microsoft Office allows an unauthorized attacker to execute code locally...

Microsoft OneNote Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code locally...

Microsoft Excel Remote Code Execution Vulnerability

Integer overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

PT-2026-58523

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description A use after free condition exists in Microsoft Office, which allows an unauthorized attacker to execute arbitrary code locally or remotely, potentially affecting the entire system. U...

PT-2026-58655

Name of the Vulnerable Software and Affected Versions Windows Media affected versions not specified Description A heap-based buffer overflow occurs in Windows Media, which is a memory corruption issue where data exceeds the allocated buffer on the heap. This allows an unauthorized attacker to...

PT-2026-58579

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An untrusted pointer dereference allows an unauthorized attacker to execute code locally via a specially crafted spreadsheet. Recommendations At the moment, there is no...

CVE-2026-15682

The CVE-2026-15682 vulnerability affects AnyDesk’s Send Support Information feature. By creating a junction, an attacker who can run low-privilege code locally can abuse the process to create arbitrary files, enabling a denial-of-service condition on affected installations. The flaw is localized ...

PYSEC-2026-2482 flyto-core has Unauthenticated Command Execution via HTTP MCP `execute_module`

Unauthenticated Command Execution via HTTP MCP executemodule Summary The HTTP MCP endpoint POST /mcp in flyto-core accepts unauthenticated JSON-RPC tools/call requests and dispatches them to arbitrary registered modules, including sandbox.executeshell, which passes attacker-controlled input...

PYSEC-2026-2518 Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates

Impact Up to 1.0.0 of home-assitant-cli or hass-cli for short an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and...

EUVD-2026-42813

Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code...

CVE-2026-47829 Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director

Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation. Affecte...

CVE-2026-47829

CVE-2026-47829 describes an argument injection flaw in bosh-cli that lets a compromised BOSH Director inject arbitrary OpenSSH options into the locally-spawned ssh process when operators run non-interactive SSH paths (e.g., bosh ssh -c, bosh logs -f). This can lead to local command execution on t...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by a command injection vulnerability due to Click

Summary Click is used by IBM Cloud Pak for Data System 1.0 as a command-line interface creation library for Python applications. CVE-2026-7246 affects Click's click.edit function, which fails to properly neutralize special elements in input, allowing attackers to inject and execute arbitrary...

PYSEC-2026-1523 Langflow vulnerable to remote code execution

langflow =1.0.18 is vulnerable to Remote Code Execution RCE as any component provided the code functionality and the components run on the local machine rather than in a sandbox...

CVE-2026-14723

A vulnerability was determined in AD-Security ADMiner 1.9.0. Affected is the function requesta of the file adminer/scripts/analysecache.py of the component Cache Handler. This manipulation of the argument sys.argv1 causes deserialization. The attack can only be executed locally. The pull request ...

CVE-2026-14702

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0. This impacts the function saveToTempFile of the file src/Markdownify.ts of the component webpage-to-markdown/youtube-to-markdown/bing-search-to-markdown. This manipulation causes insufficiently random values. The attack is restricted ...