CVE-2026-2319

A race condition in the DevTools component of Google Chrome (prior to version 145.0.7632.45 ) allows a remote attacker to potentially cause object corruption or service failure . Exploitation requires the attacker to convince a user to perform specific UI gestures and install a malicious extensio...

📄 Qualys Security Advisory - GHOST glibc gethostbyname Buffer Overflow

During a code audit performed internally at Qualys, they discovered a buffer overflow in the nsshostnamedigitsdots function of the GNU C Library glibc. This bug is reachable both locally and remotely via the gethostbyname functions, so we decided to analyze it -- and its impact -- thoroughly, and...

The vulnerability of the LERS UCHOT dispatching system, related to incorrect code generation, allows a intruder to execute arbitrary codes.

The vulnerability of the LERS dispatching system is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to generate arbitrary codes...

CVE-2026-21228

CVE-2026-21228 affects Azure Local and is due to improper certificate validation. The TALOS update describes an attacker intercepting unsecured communication between the configurator and target systems, tampering responses to trigger command injection with administrative privileges and potentiall...

CVE-2026-21228 Azure Local Remote Code Execution Vulnerability

...

CVE-2026-21537

Improper control of generation of code 'code injection' in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-2260

A vulnerability was found in D-Link DCS-931L up to 1.13.0. This affects an unknown part of the file /goform/setSysAdmin. The manipulation of the argument AdminID results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. This...

Microsoft Defender 代码注入漏洞

Microsoft Defender for Linux is Microsoft's own antivirus security software. A security vulnerability exists in Microsoft Defender for Linux that originates from improper input validation and can be exploited by remote attackers to execute arbitrary code...

Microsoft GitHub Copilot and Visual Studio 代码注入漏洞

Microsoft GitHub Copilot and Visual Studio are generative AI tools developed by the American company Microsoft. There is a code injection vulnerability in Microsoft GitHub Copilot and Visual Studio. Attackers can exploit this vulnerability to execute code remotely. The following products and...

PT-2026-7413

Name of the Vulnerable Software and Affected Versions Microsoft Defender for Linux affected versions not specified Description The software contains a flaw in how it generates code, potentially allowing an attacker on the same network to run code without authorization. There is no information abo...

CVE-2026-25807 Unauthenticated Remote Code Execution via P2P Sharing in ZAI-Shell

ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature share start opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple...

CVE-2026-2211

A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDeleteCategory.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly...

The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the getLogPlan parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...

The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the fileid parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the fileid parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the selectmonth parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries...

CVE-2026-2132

A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpdateCategory.php. The manipulation of the argument txtcat results in sql injection. The attack can be executed remotely. The exploit has bee...

CVE-2026-2130 BurtTheCoder mcp-maigret search_username index.ts command injection

A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component searchusername. Executing a manipulation of the argument Username can lead to command injection. The attack may be launched remotely. Upgrading to versio...

CVE-2026-25857 Tenda G300-F Command Injection via formSetWanDiag

Tenda G300-F router firmware version 16.01.14.2 and prior contain an OS command injection vulnerability in the WAN diagnostic functionality formSetWanDiag. The implementation constructs a shell command that invokes curl and incorporates attacker-controlled input into the command line without...

PT-2026-6932

Name of the Vulnerable Software and Affected Versions Tenda G300-F router firmware versions prior to 16.01.14.2 Description The Tenda G300-F router firmware contains an OS command injection issue in the WAN diagnostic functionality, specifically within the formSetWanDiag function. The software...