CVE-2026-87548

A flaw was found in the Installer component of Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This improper state validation could allow the attacker to bypass system access restrictions, potentially leading to...

CVE-2026-87528

A flaw was found in Google Chrome. This type confusion vulnerability, specifically in the Rust component, could allow a remote attacker to execute arbitrary code outside of the sandbox by enticing a user to visit a specially crafted HTML page...

CVE-2026-87488

A flaw was found in chromium-browser. A use-after-free vulnerability in WebGL, a web graphics library, could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This exploitation can occur by enticing a user to visit a specially crafted HTML page...

CVE-2026-87470

A flaw was found in Google Chrome. Improper quantity validation in the Tint component could allow a remote attacker to execute arbitrary code outside of the browser's security sandbox. This vulnerability can be exploited by enticing a user to visit a specially crafted HTML page. Successful...

CVE-2026-88014

A flaw was found in rclone. This vulnerability, known as Zip Slip, allows a remote attacker to write arbitrary files outside of the intended destination when processing a specially crafted ZIP archive. By manipulating archive entry names, an attacker can bypass path sanitization, leading to...

CVE-2002-0346

CVE-2002-0346 Cobalt RAQ 4 中的跨站脚本漏洞允许远程攻击者通过在 URL 中向 1 service.cgi 或 2 alert.cgi 注入 Javascript，以其他 Cobalt 用户的身份执行任意脚本。 Packetstorm 发布内容见 https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html SecurityFocus 发布内容见 https://www.securityfocus.com/bid/4211 作者 Alex Hernandez 又名 @alt3kx 厂商回应...

Cisco RV110W RV130W RV215W Router - Information leakage

A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this...

EUVD-2026-75784

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction...

EUVD-2026-75779

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

EUVD-2026-75790

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery...

EUVD-2026-75798

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

EUVD-2026-75803

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization...

EUVD-2026-75794

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-75793

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

EUVD-2026-75877

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header...

EUVD-2026-76189

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...

EUVD-2026-76701

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

CVE-2020-8958

针对 CVE-2020-8958 的概念验证脚本，使用 Python 编写。如果成功，脚本将返回 /etc/passwd 的内容。 CVE-2020-8958 广州 1GE ONU V2801RW 1.9.1-181203 至 2.9.0-181024 以及 V2804RGW 1.9.1-181203 至 2.9.0-181024 设备允许远程攻击者通过在 boaform/admin/formPing 的目标 IP 地址字段中使用 shell 元字符来执行任意操作系统命令。 要求 Python 3.X bs4 使用方法 python poc.py...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

org.apache.qpid/proton-j: Apache Qpid Proton-J: Denial of Service due to excessive allocation

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of...