MiracleLinux 8 : gstreamer1-plugins-good-1.16.1-7.el8_10.7 (AXSA:2026-1677:06)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1677:06 advisory. gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow CVE-2026-18296 gstreamer: GStreamer: Remote code executi...

PT-2026-82558

Name of the Vulnerable Software and Affected Versions Craft CMS affected versions not specified Description The Twig sandbox mechanism is configured to allow dangerous functionality from the Yii framework. This configuration allows authenticated users to achieve Remote Code Execution RCE, which i...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB é uma ferramenta Python criada para explorar a nova vulnerabilidade no WSO2 atribuída como CVE-2022-29464. Detalhes do CVE-2022-29464: Certos produtos WSO2 permitem upload de arquivos irrestrito com consequente execução remota de código. O atacante deve usar um endpoi...

CVE-2026-55182 LibreNMS: Remote Code Execution by Signal Alert Transportation Module

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...

CVE-2026-55182 LibreNMS: Remote Code Execution by Signal Alert Transportation Module

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An...

CVE-2026-55182

LibreNMS , a network monitoring system, is vulnerable to command injection in the Signal alert transport module (versions 21.6.0 through 26.5.0). The root cause lies in insufficiently escaped signal-cli path and Recipient field in the deliverAlert function of Signal.php, which are passed to unsaf...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

CVE-2026-75363

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, displayn...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-52103

A zero-click remote code execution RCE vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary commands in the context of the application without user interaction via sending a crafted payload in a text message...

CVE-2025-55182_CVE-2025-66478

CVE-2025-55182 - Esecuzione Remota di Codice nei Server Components di Next.js/React Panoramica Questo repository contiene un exploit Proof-of-Concept PoC per CVE-2025-55182, una vulnerabilità critica di Esecuzione Remota di Codice RCE che interessa i Server Components di React nelle versioni 19.x...

CVE-2026-68861

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...

CVE-2026-54245

Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...

CVE-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...

CVE-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...

CVE-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...

CVE-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...

CVE-2026-60004

CVE-2026-60004 is a critical RCE in Gitea (and Forgejo ) versions 1.17–1.27.0 (CVSS 9.8). The flaw is in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, where patches are applied in a bare temporary clone whose root is $GIT_DIR. Submitting the same malicious patch twice triggers an add/...

CVE-2026-71171

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote...