CVE-2026-21047

CVE-2026-21047 involves an out-of-bounds write in the ImsService, before SMR Jul-2026 Release 1. This condition could enable remote code execution. The impact is described as potentially arbitrary code execution by a remote attacker, with network access required and no user interaction. The remed...

SUSE-SU-2026:3339-1 Security update for apache-sshd

This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the sshd-scp component of Apache MINA SSHD. bsc1272158...

CVE-2026-11756

Technical details for CVE-2026-11756 are not publicly available in the provided documents. No specifics on affected product versions, vectors, or mitigations are provided. Monitor for updates from the sources.

CVE-2026-51275

...

Veeder-Root TLS4B Command Injection (CVE-2025-58428)

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

CVE-2026-64696

CVE-2026-64696 concerns macOS memory handling issues that may allow a remote attacker to trigger unexpected system termination or kernel memory corruption. Public descriptions indicate fixes were applied in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The incident is tied to i...

CVE-2026-43810

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user may be able to cause unexpected system...

CVE-2026-63077

CVE-2026-63077 affects JetBrains TeamCity On-Premises: unauthenticated remote code execution via deserialization of untrusted data in the agent polling protocol. Affected are TeamCity versions prior to 2025.11.7 and prior to 2026.1.3. The root cause is deserialization of untrusted data that allow...

CVE-2026-51304

...

VulnCheck KEV: CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

MiracleLinux 9 : valkey-8.0.9-1.el9_8 (AXSA:2026-1342:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1342:03 advisory. redis: use-after-free in unblock client flow may allow remote code execution CVE-2026-23479 redis: Remote code execution via use-after-free in Lua...

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Threat actors linked to the Cl0p aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure i...

Budibase: SQL Injection via `multipleStatements: true`

Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...

CVE-2025-71389

Cal.com calcom/cal.diy before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components RSC request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause...

MAL-2026-11031 Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

CVE-2026-47670

DbGate vulnerability CVE-2026-47670 affects DbGate up to version 7.1.8 (fixed in 7.1.9). The flaw lives in the /runners/load-reader endpoint where the functionName parameter is interpolated directly into a dynamic JavaScript script. An authenticated user with valid DbGate credentials can inject a...

CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

SUSE-SU-2026:3224-1 Security update for SVT-AV1, libyuv0, libaom3

This update for SVT-AV1, libyuv0, libaom3 fixes the following issues: - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash bsc1268650. - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrar...

Vulhub-vulnerability-reproduction-reports

Vulnerability Reproduction Reports This folder contains all v...

Astra Linux – Vulnerability in Chromium

The use of after free in MediaRecording in Google Chrome before version 148.0.7778.96 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code through a crafted HTML page. Chromium security severity: High...