CVE-2026-76709 Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...

CVE-2026-76709

A vulnerability exists in the internal administrative component of the HPE Networking Analytics and Location Engine (ALE) . This flaw allows an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges . Successful exploitation could lead to a f...

CVE-2026-58192: Improper Limitation of a Pathname to a Restricted Directory

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.joinstorageRoot, name and fs.rimraf witho...

ROS-20260706-73-0057

The vulnerability of the ALTER SUBSCRIPTION...REFRESH PUBLICATION command in PostgreSQL database management systems lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

ROS-20260706-73-0012

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

USN-8359-1: NNCP vulnerability

It was discovered that NNCP did not properly sanitize file paths in packet data during file requesting and file saving operations. A remote attacker could possibly use this issue to read or write arbitrary files outside of the intended directory...

The vulnerability of the TCP/IP protocol implementation in Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the TCP/IP protocol implementation in Windows operating systems relates to the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Python Task Runner module of the N8n automation platform allows a hacker to bypass the sandbox protection mechanisms and execute arbitrary code.

The vulnerability of the Python Task Runner module of the N8n automation platform relates to improper code generation management. Exploiting this vulnerability allows a remote attacker to bypass the sandbox’s security mechanisms and execute arbitrary code...

CVE-2026-27876: Improper Control of Generation of Code

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact RCE. This is enabled by a feature in Grafana OSS, so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the...

EUVD-2026-12766

FUXA Unauthenticated Remote Arbitrary Device Tag Write...

The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the gettest parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure when processing parameters like testid and taskid. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...

CVE-2025-67707

ArcGIS Server versions 11.5 and earlier on Windows and Linux are affected by an input validation issue: uploaded files are not properly validated, allowing remote unauthenticated attackers to upload arbitrary files to designated upload directories. The server architecture restricts uploaded files...

CVE-2025-67706

ArcGIS Server (Windows/Linux) 11.5 and earlier exposes a vulnerability where uploaded files are not properly validated, allowing remote unauthenticated arbitrary file uploads to designated directories. The server architecture prevents execution of uploaded files and enforces non-executable storag...

The vulnerability of SAP NetWeaver AS Java software integration platforms, related to improper code generation management, allows attackers to load any arbitrary file.

The vulnerability of SAP NetWeaver AS Java software-based integration platforms is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to download any arbitrary file remotely...

The vulnerability of the GitFlic platform, related to the lack of authentication, allows a malicious user to execute arbitrary HTTP requests on behalf of the server.

The vulnerability of the GitFlic platform’s code-related functionality lies in the lack of authentication. Exploiting this vulnerability allows a malicious actor to remotely execute arbitrary HTTP requests on behalf of the server...

CVE-2025-21042

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code...

The vulnerability of the sub_410C34() function (/cgi-bin/cstecgi.cgi) in the microprogramming software for TOTOLINK X5000R allows a perpetrator to execute arbitrary commands.

The vulnerability of the sub410C34 function /cgi-bin/cstecgi.cgi of the TOTOLINK X5000R router’s microprogramming system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability in the web interface of the IBM Planning Analytics Local software allows a perpetrator to execute arbitrary JavaScript code.

The vulnerability of the IBM Planning Analytics Local software web interface is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system lies in the insufficient protection of website structures, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...