PT-2026-84519

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description An OS Command Injection issue exists in the SMA1000 Appliance Management Console AMC. This occurs due to improper neutralization of special elements used in an OS command...

PT-2026-84470

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An unauthenticated arbitrary file write issue exists in an API endpoint. This allows an attacker to write arbitrary files to the underlying operating system, which could potentially lead to...

PT-2026-84465

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payloa...

PT-2026-84467

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A daemon in AOS-CX improperly processes malformed input. An unauthenticated remote attacker can exploit this by sending specially crafted packets to the affected service, potentially leading t...

PT-2026-84532

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A Server-Side Request Forgery SSRF issue exists where insufficient network isolation allows malicious pre-receive hook code to impersonate an internal service. This enables the...

PT-2026-84405

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticate...

CVE-2026-84374: Improper Limitation of a Pathname to a Restricted Directory

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-84190: Improper Neutralization of Special Elements used in a Command

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shellexec without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable...

PUB-A-463366627

In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-84468

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Issues in the authentication module may lead to the improper processing of malformed or truncated input. An authenticated remote attacker can exploit this by...

CVE-2026-75604: Improper Limitation of a Pathname to a Restricted Directory

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing...

ASB-A-503554490

In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-508685506

In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-449160647

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

Grav CMS 2.0.7 - RCE

!/usr/bin/env python3 Exploit Title: Grav CMS 2.0.7 - Remote Code Execution Date: 2026-07-27 Exploit Author: zer0dayf Vendor Homepage: https://getgrav.org/ Software Link: https://github.com/getgrav/grav Version: Grav CMS 2.0.7 Tested on: Ubuntu 22.04 / PHP 8.2 CVE : CVE-2026-65008 """...

KLA91255 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

KLA91254 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Denia...

KLA91252 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Security vulnerability in the Remote Settings Client...

KLA91248 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1...

CVE-2026-51974

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...