13301 matches found
CVE-2026-76043
Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
GHSA-7PWQ-Q9JF-539H kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Summary A guest mruby script running inside the Kobako sandbox can execute arbitrary Ruby in the host process, fully escaping the sandbox. Details A host embeds bound "Service" objects that guest scripts call across the wasm boundary through the transport dispatcher. The dispatcher passed the...
CVE-2026-67443
In FUXA ≤1.3.2, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity, so an unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and access the RED.httpAdmin editor. Wi...
GHSA-C9FV-CGMM-2WG7 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module
Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...
DEBIAN-CVE-2026-63337
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...
CVE-2026-63641 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...
CVE-2026-73343
Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...
CVE-2026-73341
Unauthenticated PHP Object Injection in RegistrationMagic = 6.0.9.7 versions...
CVE-2026-59940
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
CVE-2026-66793 Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...
CVE-2026-66793
In Red Hat Advanced Cluster Management for Kubernetes, the governance-policy-addon-controller allows a user with annotation permissions on a namespaced ManagedClusterAddOn resource to override the governance-policy container image. The attacker's image runs with cluster-admin privileges on the ma...
CVE-2026-66793 Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...
CVE-2026-59940 Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
EUVD-2026-60942
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
EUVD-2026-60822
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...
CVE-2026-56684
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...