260562 matches found
PT-2026-61735
Name of the Vulnerable Software and Affected Versions GRAPHIFY versions 0.3.2 through 0.4.29 Description A remote attacker can execute arbitrary code through the validate url, safe fetch, build opener, fetch html, and download binary functions. Recommendations At the moment, there is no informati...
IBM Langflow OSS code injection vulnerability (CNVD-2026-31205)
IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...
CVE-2026-52656
CVE-2026-52656 affects SJCAM AllWinner Tech SJ4000-Air prior to v1.4C and Whitelabel-based prior to v1.4C. The issue allows an attacker to execute arbitrary code via a specially crafted FEX file. Connected sources confirm affected versions and vulnerability class; PT-2026-61058 notes no public fi...
Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2026-1983)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1983 advisory. A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec...
RHEL 7 : evince (RHSA-2026:41904)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:41904 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...
Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-1951)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1951 advisory. gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guar...
PT-2026-61733
Name of the Vulnerable Software and Affected Versions fuint Member Marketing System versions prior to 1.1 Description A Cross-Site Scripting XSS issue exists that allows a remote attacker to execute arbitrary code. The flaw is located within the ClientMessageController.java file. Recommendations...
PT-2026-61604
Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description Improper isolation or compartmentalization in the connector subsystem allows an...
Cisco ASA/FTD WebVPN Double Free (CVE-2018-0101)
A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a...
The vulnerability of the DHCP Server Service for Windows operating systems allows a perpetrator to execute arbitrary code.
The vulnerability of the DHCP Server Service for Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Important: rust
Issue Overview: gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in...
Amazon Linux 2 : unbound, --advisory ALAS2UNBOUND-1.17-2026-008 (ALASUNBOUND-1.17-2026-008)
The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2UNBOUND-1.17-2026-008 advisory. NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that...
Important: unbound
Issue Overview: NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary c...
PT-2026-61663
Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.41 Description Authenticated users enrolled in a course, such as students, teachers, or DRH, can achieve remote code execution. The issue exists in the 'main/inc/ajax/lang.ajax.php' endpoint, which is only...
CVE-2026-51025
The CVE-2026-51025 entry relates to a Cross Site Scripting (XSS) flaw in the fuint Member Marketing System <= v1.0, enabling a remote attacker to execute arbitrary code via the ClientMessageController.java file. Connected sources (EUVD-2026-46139, NVD, CVE records, and third-party trackers) co...
PT-2026-61695
Name of the Vulnerable Software and Affected Versions Net::DNS versions prior to 1.56 Description Remote execution injection is possible via EDNS EXTENDED ERROR. The function decompose in Net::DNS::RR::OPT::EXTENDED ERROR parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option by tokenizing...
CVE-2026-51385
GRAPHIFY by safishamsi (Open-Source) is affected in versions 0.3.2 through 0.4.29. The issue allows a remote attacker to execute arbitrary code via the functions validate_url, safe_fetch, _build_opener, _fetch_html, and _download_binary, indicating a potential code execution vulnerability within ...
WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE
Description WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...
CVE-2026-51385
An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validateurl, safefetch, buildopener, fetchhtml and downloadbinary functions...