EUVD-2026-71679

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...

CVE-2026-78327

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...

CVE-2026-78327

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the SonicWall Network Security Manager NSM On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the...

EUVD-2026-60969

CodeWhale: Project config allowshell override enables arbitrary shell command execution via cloned repository...

CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 57f3c89471e27ac4032d9791f6885e5d4408c381. Users should upgrade to 0.8.64 or later. The original reporter analysis is...

EUVD-2026-60965

CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE...

NPM: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)

NPM: CodeWhale: rlmeval auto-approves arbitrary Python execution, bypassing the user's approval policy RCE vulnerability discovered by ? in WordPress Npm codewhale versions = 0.8.41, 0.8.64...

Exploit for CVE-2026-19900

CVE-2026-19900 LB-LINK X-PRO Authentication Bypass and RCE via...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317

Nango before version 0.71.6 contains a missing authentication vulnerability in the runner tRPC server . The exposed start procedure does not enforce the RUNNER_SECRET_KEY environment variable, allowing an unauthenticated attacker with network access to the runner port to invoke it and achieve rem...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

EUVD-2026-71631

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

CVE-2026-9317 Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests ...

EUVD-2026-71625

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

CVE-2026-53757 Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

CVE-2026-53757

Emlog , an open-source website building system, is affected in versions 2.6.29 and prior by a Zip Slip path traversal in the emUnZip() function. The function extracts all ZIP entries via ZipArchive::extractTo() but validates the ../ traversal sequence only for the first entry's subdirectory , all...

CVE-2026-53757 Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

CVE-2026-78745

An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-31020

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...