286124 matches found
GHSA-FV55-2P8J-MHM4 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-G897-47PP-HQ75 vulnerabilities
Vulnerabilities for packages: chromium...
Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 CVSS score: 8.8, has been described as a type confusion bug in V8, Chrome's JavaScript and...
CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
WordPress Hummingbird Performance plugin < 3.21.2 - Admin+ Network-Wide RCE vulnerability
Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Hummingbird versions 3.21.2...
CVE-2026-19224
The Hummingbird Performance WordPress plugin versions before 3.21.2 is vulnerable to a Remote Code Execution (RCE) flaw. The root cause is a failure to restrict a network-wide setting to only network administrators. This allows an administrator of any single site on a WordPress Multisite network ...
CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
Malicious code in timeweave (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c6450b478521f96973a556306ed36a1430407373bb1331e051faec0266e1e0d The package presents itself as a timezone/IANA cache utility but ships a manifest-driven Windows code-execution channel. updater.py defines...
EUVD-2026-70803
MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack...
EUVD-2026-70801
MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary...
EUVD-2026-70815
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...
EUVD-2026-70813
MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSIONFILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntl...
EUVD-2026-70818
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
CVE-2026-78745: Improper Access Control
An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...
Android Debug Bridge Remote Code Execution
CVE-2026-78745 affects HiDPT / Weyon HiDPTAndroid devices using the Hi3751V350 and Hi3751V352EDMO platforms. The vulnerability allows a remote attacker to execute arbitrary code through the Android Debug Bridge adbd daemon...
CVE-2026-31020
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...
EUVD-2026-71612
PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...
EUVD-2026-71610
Cross Site Scripting vulnerability in Netgate pfSense Plus software versions = 26.03 pfSense CE software versions = 2.8.1 allows a remote attacker to execute arbitrary code via the captiveportalstatus.widget.php file...
CVE-2026-71620
CVE-2026-71620 is a file upload vulnerability in Zhao-github ApiAdmin v5.0.1 , classified by Rapid7 as an Unrestricted Upload of File with Dangerous Type . A remote attacker can upload a crafted .php file to achieve arbitrary code execution (RCE). CISA's SSVC assessment rates exploitation as none...