322814 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-104711
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the...
Linux Distros Unpatched Vulnerability : CVE-2026-49878
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code...
Linux Distros Unpatched Vulnerability : CVE-2026-105315
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the...
CVE-2026-104711
Apache Struts has an OGNL expression-injection vulnerability in the legacy RESTful action mapper. A crafted request to an application configured to use this mapper may lead to remote code execution. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are n...
CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32-
CVE-2004-1561-Icecast-Header-Overwrite-buffer-overflow-RCE-2.0.1-Win32- Usage Reverse shell listener with Ncat root@Kali:/TryHackme/Ice nc -nlvp 443 listening on any 443 ... connect to 192.168.92.128 from UNKNOWN 192.168.92.133 49211 Microsoft Windows Version 6.1.7601 Copyright c 2009 Microsoft...
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...
EUVD-2026-91720
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution...
GHSA-27VJ-QCQG-25RC fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document Kerchunk format supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template....render... calls in three locations. An attacker who controls the...
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...
GHSA-5GMW-XHRV-C9V3 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
tinypool passes worker options to new Worker by reading them off a plain object whose prototype is Object.prototype. Options the application did not set are resolved through the prototype chain and then passed explicitly to workerthreads.Worker. Node core ignores Worker options inherited from...
NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution vulnerability discovered by ? in WordPress Npm tinypool versions = 2.1.0...
EUVD-2026-81584
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit...
EUVD-2026-45272
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass...
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...
EUVD-2026-91120
Langflow: Title Authenticated Remote Code Execution in validatecode via Malicious Decorators Description...
GHSA-W584-2H2R-2HVF Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
Summary: A critical Authenticated Remote Code Execution RCE vulnerability exists in the validatecode function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec function. While it attempts to restrict execution to function definitions, i...
CVE-2025-47227
CVE-2025-47227 Exploit for CVE-2025-47227 - ScriptCase Password Reset Pre-Auth CVE-2025-47227 is a pre-auth authentication bypass CVSS 9.8 in the ScriptCase Production Environment ≤ 9.12.006. The login.php endpoint allows resetting the administrator password without a token, email validation, or...
CVE-2026-27966
CVE-2026-27966 — Langflow Remote Code Execution Scanner Pre-Auth Route Injection + Vertex Injection → Python Code Execution Overview CVE-2026-27966 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Langflow versions prior to 1.8.0. The vulnerability stems...
EUVD-2026-92799
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution RCE on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exe...