286166 matches found
OESA-2026-3626 perl-Net-DNS security update
Net :: DNS is a collection of Perl's Domain Name System resolvers. It allows programmers to perform DNS queries for gethostbyname and gethostbyaddr functions. Security Fixes: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR...
OESA-2026-3601 aom security update
The Alliance for Open Media’s focus is to deliver a next-generation video format that is: Security Fixes: An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows ...
CVE-2026-86185
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...
EUVD-2026-71994
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...
CVE-2026-86185
Bilibili Desktop through 1.18.0 contains two compounding weaknesses: TLS certificate verification is disabled process-wide, and unsigned remote JavaScript configuration is executed without integrity checks. An on-path attacker can intercept configuration fetches, inject arbitrary JavaScript that ...
CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...
CVE-2026-86185 Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary JavaScript executed in the renderer...
EUVD-2026-71991
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handleformsubmission' function. This makes it possible for...
CVE-2026-86169
Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...
CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching
Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...
EUVD-2026-71971
Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...
CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching
Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...
CVE-2026-86169
Axolotl (through 0.18.0 ), a Python-based LLM fine-tuning framework, contains a remote code execution vulnerability in its multipack patch code path. The root cause is that the trust_remote_code parameter defaults to None instead of False, effectively bypassing the security guard. An attacker who...
CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching
Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...
CVE-2026-86121
Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...
CVE-2026-86124 AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary bash commands within the container, gaining acces...
Exploit for CVE-2026-75865
CVE-2026-75865 Proof-of-concept and technical write-up for...
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Adversary Research Team said it observed attackers exploiting CVE-2026-81578 and CVE-2026-82078 – an authentication bypa...
CVE-2026-19887
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback uscesactionactingtransaction. Unauthenticated attackers can store arbitrary 'reserve' key/value...