CVE-2026-11756

Technical details for CVE-2026-11756 are not publicly available in the provided documents. No specifics on affected product versions, vectors, or mitigations are provided. Monitor for updates from the sources.

CVE-2026-11756 Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution...

CVE-2026-51275

...

PT-2026-65579

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 Description Remote code execution and path-segment injection are possible when the collectiveController-1.0 feature is enabled. Path-segment injection occurs when an...

Veeder-Root TLS4B Command Injection (CVE-2025-58428)

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

CVE-2026-64696

This vulnerability affects macOS Sequoia 15.7.8 , macOS Sonoma 14.8.8 , and macOS Tahoe 26.6 . The root cause is improper memory handling , which could allow a remote user to cause unexpected system termination or corrupt kernel memory . To remediate this issue, users should update to the affecte...

CVE-2026-43810

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user may be able to cause unexpected system...

CVE-2026-63077

CVE-2026-63077 affects JetBrains TeamCity On-Premises: unauthenticated remote code execution via deserialization of untrusted data in the agent polling protocol. Affected are TeamCity versions prior to 2025.11.7 and prior to 2026.1.3. The root cause is deserialization of untrusted data that allow...

CVE-2026-51304

...

MiracleLinux 9 : valkey-8.0.9-1.el9_8 (AXSA:2026-1342:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1342:03 advisory. redis: use-after-free in unblock client flow may allow remote code execution CVE-2026-23479 redis: Remote code execution via use-after-free in Lua...

VulnCheck KEV: CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

Digital-Archiving-Solutions-v1.02-Remote-Code-Execution-POC

Digital-Archiving-Solutions-v1.02-Remote-Code-Execution-POC T...

Exploit for CVE-2026-58480

CVE-2026-58480 / CVE-2026-15158 — Blocksy Companion Pro RCE...

Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE

Threat actors linked to the Cl0p aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure i...

Budibase: SQL Injection via `multipleStatements: true`

Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...

CVE-2025-71389

Cal.com calcom/cal.diy before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components RSC request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause...

MAL-2026-11031 Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

CVE-2026-47670

DbGate vulnerability CVE-2026-47670 affects DbGate up to version 7.1.8 (fixed in 7.1.9). The flaw lives in the /runners/load-reader endpoint where the functionName parameter is interpolated directly into a dynamic JavaScript script. An authenticated user with valid DbGate credentials can inject a...

CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

SUSE-SU-2026:3224-1 Security update for SVT-AV1, libyuv0, libaom3

This update for SVT-AV1, libyuv0, libaom3 fixes the following issues: - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash bsc1268650. - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrar...