EUVD-2026-60965

CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317

Nango before version 0.71.6 contains a missing authentication vulnerability in the runner tRPC server . The exposed start procedure does not enforce the RUNNER_SECRET_KEY environment variable, allowing an unauthenticated attacker with network access to the runner port to invoke it and achieve rem...

EUVD-2026-71631

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-53757 Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

CVE-2026-53757

Emlog , an open-source website building system, is affected in versions 2.6.29 and prior by a Zip Slip path traversal in the emUnZip() function. The function extracts all ZIP entries via ZipArchive::extractTo() but validates the ../ traversal sequence only for the first entry's subdirectory , all...

CVE-2026-53757 Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

CVE-2026-78745

An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-31020

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-44402

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...

CVE-2026-18658

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

EUVD-2026-71601

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

CVE-2026-18658 IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

CVE-2026-18658 IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

CVE-2026-18658

IBM Operational Decision Manager is vulnerable to SQL injection (CWE-89) in versions 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 . An unauthenticated remote attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the appli...

CVE-2026-19298

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain an authorization policy bypass in the authenticated flow-build endpoint . While the dedicated custom component API correctly enforces the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true control (returning HTTP 403 to non-superusers), the flow-build...

CVE-2026-19298 Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...