17328 matches found
CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
Overview On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been...
EUVD-2026-45263
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation...
CVE-2026-8481
Langflow OSS versions 1.0.0–1.10.0 are affected by a remote code execution vulnerability in the code validation endpoint. The POST /api/v1/validate/code endpoint executes user-supplied Python code via Python’s built-in exec() without sandboxing or input validation, allowing any authenticated user...
CVE-2026-9762
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
CVE-2026-9198
IBM Langflow OSS versions 1.0.0–1.10.0 are affected by an unauthenticated remote code execution (RCE) vulnerability that chains two endpoints: /api/v1/auto_login (which mints a superuser token for callers when AUTO_LOGIN is enabled) and /api/v1/validate/code (which executes user-supplied Python c...
EUVD-2026-45234
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
EUVD-2026-45014
The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification i.e. before SCTP integrity checks or IPsec policy are applied a remote, unauthenticated...
CVE-2026-44632 Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino...
MAL-2026-10689 Malicious code in pylogora (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfecc686b83d148b0b68acd99fe38f484c035c5b9c59fb7623378866e8e307cc pylogora/init.py invokes a at module top level, so any import pylogora triggers the payload. a base64-decodes hidden URLs and filesystem paths,...
CVE-2026-13385
An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middleMITM user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware '...
JLSEC-2026-680 Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an...
Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length...
JLSEC-2026-711 Stack Buffer Overflow in `wc_HpkeLabeledExtract` via Oversized ECH Config
Stack Buffer Overflow in wcHpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH Encrypted Client Hello support, where a maliciously crafted ECH config could cause a stack buffer overflow on the client side, leading to potential remote execution and client...
CVE-2026-53633
Vitest CVE-2026-53633 affects Vitest Browser Mode (3.0.0–3.2.5, 4.1.8, and 5.0.0-beta.4), where a cdp() API exposes raw Chrome DevTools Protocol methods without gates. A remote client with exposed browser API metadata can use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.con...
EUVD-2026-44117
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network...
CVE-2026-56642
Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network...
CVE-2026-56642 Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability
...
CVE-2026-55031 Microsoft Excel Remote Code Execution Vulnerability
...
CVE-2026-55017
Mode C: CVE-2026-55017 is a heap-based buffer overflow affecting Microsoft Office, enabling a local attacker to execute code. The available connected documents confirm this vulnerability within Microsoft Office products (Office components cited in the NCSC advisory and multiple CVE trackers). Roo...