29663 matches found
SUSE CVE-2026-43663
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash...
SUSE CVE-2026-43699
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash...
SUSE CVE-2026-43726
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash...
SUSE CVE-2026-43732
A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may disclose sensitive user information...
SUSE CVE-2026-43734
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected process crash...
ROOT-OS-DEBIAN-13-CVE-2026-34589 CVE-2026-34589 in rootio-openexr - Patched by Root
Root has patched CVE-2026-34589 in the rootio-openexr package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-48074 CVE-2025-48074 in rootio-openexr - Patched by Root
Root has patched CVE-2025-48074 in the rootio-openexr package for Root:Debian:13. Multiple fixed versions available...
CVE-2026-42168
The CVE covers django-pyas2 up to version 1.2.3, where the Partner model’s cmd_receive and cmd_send fields are passed directly to os.system() in pyas2/utils.py. The underlying vulnerability is OS command injection, exploitable when an AS2 message is received or sent, allowing an authenticated adm...
CVE-2026-55173 AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...
EUVD-2026-45040
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...
Malicious code in dde-common (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9c1ea29800a587d513d49d1ed9ddd14d9cf9d246e6622f57389e9c91606ad5 The pypi package dde-common advertises itself as 'base types and interfaces' but exposes only a no-op DdeCommon stub. Its setup.py copies a...
ROOT-OS-DEBIAN-12-CVE-2024-41957 CVE-2024-41957 in rootio-vim - Patched by Root
Root has patched CVE-2024-41957 in the rootio-vim package for Root:Debian:12. Multiple fixed versions available...
July 14, 2026—KB5101649 (OS Build 28000.2525)
None None...
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...
CVE-2026-63304
AVideo
ROOT-OS-DEBIAN-13-CVE-2026-48959 CVE-2026-48959 in rootio-perl - Patched by Root
Root has patched CVE-2026-48959 in the rootio-perl package for Root:Debian:13. Multiple fixed versions available...
The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing a malicious actor to execute arbitrary commands remotely.
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
NPM: systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
NPM: systeminformation: OS command injection in networkInterfaces via interfaces5 source-directive path on Linux vulnerability discovered by ? in WordPress Npm systeminformation versions = 5.31.6...
