17315 matches found
CVE-2026-64696
CVE-2026-64696 concerns macOS memory handling issues that may allow a remote attacker to trigger unexpected system termination or kernel memory corruption. Public descriptions indicate fixes were applied in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The incident is tied to i...
CVE-2026-43810
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory...
CVE-2026-63077
CVE-2026-63077 affects JetBrains TeamCity On-Premises: unauthenticated remote code execution via deserialization of untrusted data in the agent polling protocol. Affected are TeamCity versions prior to 2025.11.7 and prior to 2026.1.3. The root cause is deserialization of untrusted data that allow...
Spring Cloud Gateway Code Injection
Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...
VulnCheck KEV: CVE-2026-58138
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
MiracleLinux 9 : valkey-8.0.9-1.el9_8 (AXSA:2026-1342:03)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1342:03 advisory. redis: use-after-free in unblock client flow may allow remote code execution CVE-2026-23479 redis: Remote code execution via use-after-free in Lua...
Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
Threat actors linked to the Cl0p aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure i...
MAL-2026-11031 Malicious code in govapkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...
CVE-2026-47670
DbGate vulnerability CVE-2026-47670 affects DbGate up to version 7.1.8 (fixed in 7.1.9). The flaw lives in the /runners/load-reader endpoint where the functionName parameter is interpolated directly into a dynamic JavaScript script. An authenticated user with valid DbGate credentials can inject a...
CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...
SUSE-SU-2026:3224-1 Security update for SVT-AV1, libyuv0, libaom3
This update for SVT-AV1, libyuv0, libaom3 fixes the following issues: - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash bsc1268650. - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrar...
Vulhub-vulnerability-reproduction-reports
Vulnerability Reproduction Reports This folder contains all v...
UBUNTU-CVE-2025-50327
An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism...
OPENSUSE-SU-2026:21437-1 Security update for perl-Net-DNS
This update for perl-Net-DNS fixes the following issues: Changes in perl-Net-DNS: - CVE-2026-64194: Fixed a Denial of Service via deep DNS compression pointer chains bsc1272214 - CVE-2026-64193: Fixed a remote execution injection bsc1272212...
CVE-2026-64831
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vpsnumhrdparameter...
CVE-2026-46737
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
EUVD-2026-47735
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-46737
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-46737
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...