286286 matches found
CVE-2026-75431: Use of Hard-coded Cryptographic Key
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
PT-2026-85781
PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...
CVE-2026-75431
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
CVE-2026-31020
The DocsGPT application (version 0.15.0 and below ) is vulnerable to a server-side template injection (SSTI) in its custom prompt feature. The root cause is the rendering of user-supplied prompt data using Jinja templates without proper input sanitization or sandboxing. An unauthenticated attacke...
CVE-2026-82923: Missing Authorization
The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...
CVE-2026-44402: Unrestricted Upload of File with Dangerous Type
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...
CVE-2026-85694: Improper Control of Generation of Code
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...
PT-2026-85695
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...
CVE-2026-75430
PowerJob Worker version 5.1.2 (and likely earlier) exposes the /worker/deployContainer HTTP endpoint without authentication on its default transport port, allowing a remote unauthenticated attacker to execute arbitrary code . The vulnerability is scored CVSS 9.8 (Critical) — network attack vector...
PT-2026-86247
CVE-2026-50894: Unrestricted file upload in easyadmin v2.0.2.2 enables authenticated RCE and full server takeover. CVSS not scored, but impact is critical. If you use easyadmin, restrict access and audit uploads now. Patch https://t.co/GZLmhBXY4r cybersecurit valtersit CVE CVEAlert infosec SysAdm...
CVE-2026-31020
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...
CVE-2026-85604: Improper Control of Generation of Code
Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106455)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106455 advisory. GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...
MiracleLinux 9 : gimp-3.0.4-4.el9_8.10 (AXSA:2026-1755:10)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1755:10 advisory. gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow CVE-2026-59090 gimp: GIMP: Arbitrary code execution via crafted TIF fil...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106462)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106462 advisory. GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...
The vulnerability of the PDB decoder in the console-based ImageMagick graphics editor allows a hacker to execute arbitrary code.
The vulnerability of the PDB console-based ImageMagick graphics editor relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
CVE-2025-67066
SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...
CVE-2026-78745
An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352EDMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge ADB daemon adbd...
CVE-2026-79423
A remote code execution (RCE) vulnerability exists in the admin_config.php component of seacms v13.6 . The flaw allows an authenticated attacker to execute arbitrary code by sending a crafted POST request . This vulnerability is characterized as an Improper Neutralization of Special Elements used...