18037 matches found
CVE-2026-24002: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Grist is spreadsheet software using Python as its formula language. Grist offers several methods for running those formulas in a sandbox, for cases where the user may be working with untrusted spreadsheets. One such method runs them in pyodide, but pyodide on node does not have a useful sandbox...
CVE-2025-69762
Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execution...
CVE-2021-47851
Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. Attackers can leverage the /op=command endpoint to download and execute payloads by sending crafted JSON requests with malicious script...
EUVD-2026-3660
GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server...
CVE-2021-47817
OpenEMR 5.0.2.1 has a cross-site scripting vulnerability that allows authenticated attackers to inject JavaScript via user profile parameters. The underlying issue enables an attacker to craft a payload to download and run a web shell, leading to remote command execution on the vulnerable OpenEMR...
Security information for Hitachi Disk Array Systems
Overview CVE-2025-54100 | PowerShell Remote Code Execution Vulnerability CVE-2025-55233 | Windows Projected File System Elevation of Privilege Vulnerability CVE-2025-59516 | Windows Storage VSP Driver Elevation of Privilege Vulnerability CVE-2025-59517 | Windows Storage VSP Driver Elevation of...
OpenPLC code injection vulnerability
OpenPLC is an open-source programmable logic controller developed by Thiago Alves. It provides low-cost industrial solutions for automation and research purposes. Version OpenPLC v3 has a code injection vulnerability, which stems from authenticated remote code execution through the hardware...
PT-2026-3799
GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery CSRF vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. This may allow unauthorized changes but does not...
CVE-2025-69762
Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formSetIptv via the list parameter, which can cause memory corruption and enable remote code execution...
Control Web Panel key parameter command injection
Added: 01/21/2026 Background Control Web Panel is a web hosting panel for Linux. Problem A command injection vulnerability allows remote attackers to execute arbitrary commands by sending a specially crafted key parameter. Resolution Upgrade to Control Web Panel 0.9.8.1209 or higher. References...
CVE-2026-22844 Zoom Node Deployments - Command Injection
A Command Injection vulnerability in Zoom Node Multimedia Routers MMRs before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access...
MiracleLinux 9 : dotnet7.0-7.0.110-1.el9.ML.1 (AXSA:2023-6345:24)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6345:24 advisory. dotnet: RCE under dotnet commands CVE-2023-35390 dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack CVE-2023-381...
MiracleLinux 7 : samba-4.10.16-18.el7 (AXSA:2022-3026:02)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3026:02 advisory. samba: Out-of-bounds heap read/write vulnerability in VFS module vfsfruit allows code execution CVE-2021-44142 Tenable has extracted the preceding descriptio...
MiracleLinux 8 : pcp-5.3.7-20.el8 (AXSA:2024-8455:03)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8455:03 advisory. pcp: exposure of the redis server backend allows remote command execution via pmproxy CVE-2024-3019 Tenable has extracted the preceding description block...
CVE-2026-23885 AlchemyCMS has Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper
Alchemy is an open source content management system engine written in Ruby on Rails. Prior to versions 7.4.12 and 8.0.3, the application uses the Ruby eval function to dynamically execute a string provided by the resourcehandler.enginename attribute in Alchemy::ResourcesHelperresourceurlproxy. Th...
SiYuan code injection vulnerability
SiYuan is a privacy-oriented personal knowledge management system developed by SiYuan. Versions of SiYuan prior to 3.5.4 contained a code injection vulnerability. This vulnerability stemmed from the/api/attr/setBlockAttrs API, which allowed attackers to inject arbitrary HTML attributes into the...
Exploit for Path Traversal in Debian Debian_Linux
CVE-2018-11235 1. ssh to your vps. 2. Clone this repo: ba...
CVE-2026-23744
MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam...
CVE-2025-61937
The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the model application server...