860 matches found
EUVD-2026-47592
A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...
CVE-2026-16488
A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...
CVE-2026-16488
The CVE covers QUSETIONS MiniCode-Python 0.1.0 where the subprocess.Popen call in minicode/config.py of the Project File Handler is vulnerable to OS command injection. The issue can be exploited remotely with high attack complexity and no privileges required, though user interaction is indicated ...
GO-2026-5936 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers in github.com/zhenorzz/goploy
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and projectfile handlers in github.com/zhenorzz/goploy...
CVE-2026-49145
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include...
GHSA-26RH-24RG-J3VV Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers
Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...
PT-2026-56305
Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...
CVE-2026-48192
CVE-2026-48192 affects Mendix Studio Pro across multiple versions (10.x and 11.x) with a flaw where built project files are not properly validated/sanitized during the build pipeline. An attacker could trick a user into opening and running a specially crafted malicious project locally, potentiall...
CVE-2026-52751
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes...
CVE-2026-52751 Ghidra < 12.1 - Remote Code Execution via Unfiltered RMI Deserialization in Shared Project Connection
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes...
CVE-2026-10737
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the viewfile function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links f...
CVE-2026-45555
Roslyn CodeLens MCP Server is a Roslyn-based MCP server providing semantic code intelligence for .NET codebases. From 0.0.9 to 1.17.0, the getdiagnostics MCP tool loads and executes all DiagnosticAnalyzer assemblies referenced by the target solution without any allowlist, signature check, or user...
[SECURITY] [DSA 6299-1] kdenlive security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6299-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 26, 2026 https://www.debian.org/security/faq -...
Linux Distros Unpatched Vulnerability : CVE-2023-47268
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host where the project is...
openSUSE 16 Security Update : kdenlive (openSUSE-SU-2026:20723-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20723-1 advisory. Changes in kdenlive: - CVE-2026-45184: Fixed a remote code execution through opening a malicious project file boo1264711. Tenable has extracted the...
CVE-2026-45184
A flaw was found in Kdenlive. This vulnerability allows an attacker to use dangerous proxy parameters when a user opens a specially crafted project file. Successful exploitation could lead to arbitrary code execution or information disclosure on the affected system...
OPENSUSE-SU-2026:20723-1 Security update for kdenlive
This update for kdenlive fixes the following issues: Changes in kdenlive: - CVE-2026-45184: Fixed a remote code execution through opening a malicious project file boo1264711...
