Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the parsing process. An attacker can gain unauthorized access to sensitive information by submitting a specially crafted document that triggers the inclusion of functionality from an untrusted contro...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the parsing process. An attacker can gain unauthorized access to sensitive information by submitting a specially crafted document that triggers the inclusion of functionality from an untrusted contro...

CVE-2026-73226

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-18699

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...

CVE-2026-18697

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos router process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the...

CVE-2026-73226

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-73226 Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and...

CVE-2026-68187

A flaw was found in the Linux kernel's exec subsystem, specifically within the transferargstostack function. A local user could provide a specially crafted argument or environment string during process creation, causing an unsigned loop counter to wrap. This leads to an out-of-bounds read and...

EUVD-2026-56862

An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service...

CVE-2026-68362

A flaw was found in the ath11k Wi-Fi driver for the Linux kernel. During the firmware ready process, the driver incorrectly sets a flag indicating successful initialization even when the process fails. This inconsistent state can lead to a NULL pointer dereference when the driver attempts a...

EUVD-2025-210695

A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution...

CVE-2025-8087

CVE-2025-8087 describes a DLL hijacking vulnerability in AMD Power Design Manager. The issue allows a malicious local attacker to escalate privileges during the uninstallation process, potentially enabling arbitrary code execution. Affected component is AMD Power Design Manager; root cause is DLL...

CVE-2025-8087

A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution...

CVE-2025-8087

A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution...

EUVD-2026-56385

Heap-based buffer overflow in Microsoft Local Security Authority Server lsasrv allows an authorized attacker to execute code over a network...

CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

EUVD-2026-56527

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

CVE-2026-73081

CVE-2026-73081 affects Activepieces prior to 0.80.0. The worker’s code-compilation pipeline creates the on-disk path for a Code step from the step name and passes it to a shell-invoked build command. A step name containing shell metacharacters can break out of the intended build invocation, allow...

CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...