EUVD-2026-60822

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

CVE-2026-56684

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

EUVD-2026-60774

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444

The WordPress Cwicly plugin (≤1.4.4) allows authenticated contributor-level users to trigger remote code execution via a network-accessible, low-complexity attack requiring no user interaction. CVSS 3.1 scores 9.9 (CRITICAL). Patchstack advisory: https://patchstack.com/database/wordpress/plugin/c...

CVE-2026-75827

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

Exploit for CVE-2026-14669

CVE-2026-14669 - PostgreSQL tochar Time Zone Abbreviation H...

CVE-2026-75827

Grav before 2.0.15 uses an incomplete denylist in Blueprint dynamic-data validation, allowing attackers with page-edit or blueprint-config access to invoke error_log via a data directive and append PHP payloads to web-accessible files, achieving remote code execution. CVSS 4.0 score is 9.3 (CRITI...

CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

BIT-AIRFLOW-2026-67260 Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_kwargs deserialization

Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new awaitinginput task state swept by the scheduler. That sweep deserializes the task instance's nextkwargs without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an...

CVE-2026-70429 vulnerabilities

Vulnerabilities for packages: jenkins...

PT-2026-77330

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description An incorrect calculation in the V8 engine allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. V8 is the...

The vulnerability of the standard authentication client of the Data Hub Adapter for the SAP Commerce Cloud platform allows a hacker to execute arbitrary code and cause complete system compromise.

The vulnerability of the standard authentication client for Data Hub Adapters in the SAP Commerce Cloud platform is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, leading to a complete compromise of the system...

KLA91225 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability can ...

CVE-2026-69148

creationtimestamp| type| source ---|---|--- 2026-08-17 22:31:53+00:00| seen| https://gist.github.com/alon710/21683b4d8ecf3653b83554b3c12c2c47 2026-08-17 22:35:03+00:00| published-proof-of-concept| https://github.com/mlflow/mlflow/security/advisories/GHSA-gqch-g4w5-7qcw 2026-08-17 23:47:49+00:00|...

CVE-2026-65640

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...

CVE-2026-65974

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process...