38585 matches found
CVE-2026-41011
PackagePersister.validatetgz builds "tar -tf tgz 2&1" where tgz = File.joinreleasedir, 'packages', "name.tgz" and name = packagemeta'name' comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x — i.e., /bin/sh -c. No...
CVE-2026-41500
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to version 3.3.8, a command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:150. The runMac function appends attacker-controlled remote releaseInfo.name directly into an...
CVE-2026-41858
Weak Randomness / Insecure Cryptographic Primitive CWE-338 in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomizepassword job exists solely t...
CVE-2026-41010
ReleaseJobunpack builds jobdir = File.join@releasedir, 'jobs', name and jobtgz = File.join@releasedir, 'jobs', "name.tgz" where name returns @jobmeta'name', a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolat...
CVE-2026-42231
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodies in n8n's webhook handler allowed prototype pollution via a crafted XML payload. An authenticated user with permission to create or modi...
CVE-2026-11401 Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...
CVE-2026-11401 Privilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL
An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rdssuperuser, via a crafted function created by the...
CVE-2026-46399
CVE-2026-46399 affects HAX CMS with PHP backend prior to v26.0.0. The vulnerability is an authenticated file overwrite that allows an attacker to configure malicious Git filter commands, leading to code execution on the HAX CMS server. The issue is specific to the PHP version before 26.0.0; the f...
CVE-2026-11336
CVE-2026-11336 affects tittuvarghese CollegeManagementSystem (Admin Interface). The vulnerability resides in an unknown function within dashboard_page/admin_page.php where manipulation of the UserAuthData argument leads to improper authorization. This can be exploited remotely; public disclosure ...
Chromium: CVE-2026-10948 Use after free in WebRTC
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-6357 affecting package python-pip for versions less than 24.2-8
CVE-2026-6357 affecting package python-pip for versions less than 24.2-8. A patched version of the package is available...
CVE-2025-1178 affecting package gdb for versions less than 13.2-9
CVE-2025-1178 affecting package gdb for versions less than 13.2-9. A patched version of the package is available...
CVE-2026-41889 affecting package telegraf for versions less than 1.31.0-22
CVE-2026-41889 affecting package telegraf for versions less than 1.31.0-22. A patched version of the package is available...
CVE-2026-5172 affecting package dnsmasq for versions less than 2.92-1
CVE-2026-5172 affecting package dnsmasq for versions less than 2.92-1. A patched version of the package is available...
CVE-2026-43895 affecting package jq for versions less than 1.7.1-6
CVE-2026-43895 affecting package jq for versions less than 1.7.1-6. A patched version of the package is available...
CVE-2026-43896 affecting package jq for versions less than 1.7.1-6
CVE-2026-43896 affecting package jq for versions less than 1.7.1-6. A patched version of the package is available...
CVE-2026-4948 affecting package firewalld for versions less than 2.0.2-4
CVE-2026-4948 affecting package firewalld for versions less than 2.0.2-4. A patched version of the package is available...
CVE-2026-2291 affecting package dnsmasq for versions less than 2.92-1
CVE-2026-2291 affecting package dnsmasq for versions less than 2.92-1. A patched version of the package is available...