269366 matches found
CVE-2026-19559
Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-19556
CVE-2026-19556 is a use-after-free vulnerability in the V8 JavaScript engine within Google Chrome prior to 151.0.7922.137, allowing a remote attacker to execute arbitrary code inside the browser sandbox when a user visits a crafted HTML page. Multiple sources (NVD, Red Hat, Debian OSV, EUVD) desc...
CVE-2026-66147
An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests...
CVE-2026-55676
Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...
CVE-2026-29035
CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...
DEBIAN-CVE-2026-29035
CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...
CVE-2026-14863
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...
UBUNTU-CVE-2026-29035
CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the readwebsocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate...
Patch Tuesday - August 2026
Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday, including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever...
CVE-2026-14863
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...
CVE-2026-14863 FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...
EUVD-2026-56976
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...
CVE-2026-14863 FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection
FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...
CVE-2026-14863
FileRun
CVE-2026-43631
A flaw was found in llama.cpp. This use-after-free vulnerability in the llama-server component, specifically within the vocab pointer when the --sleep-idle-seconds feature is enabled, allows unauthenticated remote attackers to execute arbitrary code. Attackers can exploit this by sending requests...
CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component
Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...
CVE-2026-55676
Malcolm’s file-upload PHP backend allows unrestricted uploads: an empty allow-list means any extension is accepted, and the filename sanitizer preserves .php. Uploaded files land under /var/www/upload/server/php/files and are served via nginx to php-fpm, enabling an authenticated GET to execute t...
CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component
Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...
