23380 matches found
PT-2026-99391
Name of the Vulnerable Software and Affected Versions Froxlor versions 2.0.0 through 2.3.10 Description Stored cross-site scripting occurs when a user with customer privileges uploads an SSL certificate. The Certificates API add and update methods use openssl x509 parse to process the certificate...
Webmin <= 1.920 - Unauthenticated Remote Command Execution
Webmin =1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in passwordchange.cgi. id: CVE-2019-15107 info: name: Webmin = 1.920 - Unauthenticated Remote Command Execution author: bp0lr severity: critical description: Webmin =1.920. is vulnerable to an...
Redis 8.2.x < 8.2.9 / 8.4.x < 8.4.6 / 8.6.x < 8.6.6 / 8.8.x < 8.8.2 / 8.10.x < 8.10.1 Multiple Vulnerabilities
The version of Redis installed on the remote host is 8.2.x prior to 8.2.9, 8.4.x prior to 8.4.6, 8.6.x prior to 8.6.6, 8.8.x prior to 8.8.2, or 8.10.x prior to 8.10.1. It is, therefore, affected by multiple vulnerabilities: - A use-after-free vulnerability in the tlsProcessPendingData function,...
ROS-20260925-73-0099
The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
GHSA-3CJ3-HQCR-G934 Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Summary The Cline Hub dashboard server @cline/cline-hub, launched via the cline dashboard CLI command, accepts WebSocket connections on the /browser endpoint without validating the HTTP Origin header. When ROOMSECRET is not set—the default for local 127.0.0.1 binds—isAuthorizedBrowserRequest...
Exploit for Code Injection in Apache Ofbiz
ofbiz-xmlrpc-rce CVE-2023-49070 PoC for the Apache OFBiz XM...
CVE-2026-81547
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...
CVE-2026-81552
IBM DataStage on Cloud Pak for Data version 5.4.0.0 is vulnerable to a flaw that could allow a remote authenticated attacker to execute arbitrary commands . The root cause is identified as the improper neutralization of environment variables . This vulnerability carries a High base severity (CVSS...
CVE-2026-81547 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...
EUVD-2026-86014
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-96515
This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...
ROS-20260924-73-0001
The vulnerability in Dracut is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2026-80425 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
USN-8809-1: libgit2 vulnerability
Kazuma Matsumoto and Isabel Mill discovered that libgit2 incorrectly handled certain repository URLs when using the SSH transport. A remote attacker could possibly use this issue to execute arbitrary commands...
Malicious code in n8n-nodes-metricsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...
MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...
EUVD-2026-84947
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of special elements used in an ESQL command...
EUVD-2026-84972
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
CVE-2026-96456: Concurrent Execution using Shared Resource with Improper Synchronization
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...