CVE-2026-102116

The Kiteworks Email Protection Gateway is vulnerable to a path traversal weakness. An authenticated administrator could potentially write a file outside its intended location and trigger the application to execute it. This could lead to remote code execution (RCE) under the privileges of the unde...

CVE-2026-102117

The Kiteworks Core platform is vulnerable to Remote Code Execution (RCE) when the remote-support capability is licensed and enabled. An authenticated System Administrator who possesses the key protecting the submitted data can redirect the system's outbound support connection to a destination of ...

CVE-2026-102130

The Kiteworks Email Protection Gateway is vulnerable to Remote Code Execution (RCE) due to insufficient validation of uploaded backup content. An authenticated administrator can influence how the application loads these backups to execute arbitrary code on the gateway as the underlying service ac...

CVE-2026-91106

A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions. Mitigation To mitigate...

CVE-2026-91104

A flaw was found in HPLIP. A heap-based buffer overflow could potentially allow an attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose sensitive information, or perform unauthorized file modifications under certain conditions. Mitigation To mitigate...

CVE-2026-102101

Kiteworks Core versions before 9.5.0 are vulnerable to a deserialization of untrusted data weakness. This vulnerability allows an attacker to potentially achieve remote code execution on the appliance by providing crafted data that is deserialized unsafely. However, this issue is not exploitable ...

CVE-2026-102142

The Kiteworks appliance is vulnerable to Remote Code Execution due to a Server-Side Template Injection flaw in the system notification template rendering process. The underlying cause is a template engine that evaluates expressions contained within the stored template body. An authenticated Syste...

CVE-2026-102097

Kiteworks Email Protection Gateway versions before 9.5.0 is vulnerable to Remote Code Execution (RCE) . The flaw exists because the gateway fails to sufficiently validate the contents of configuration files imported by an authenticated administrator . An attacker with administrative privileges co...

CVE-2026-101884

OpenClaw Windows Node versions before 2026.7.1 are vulnerable to Remote Code Execution due to an incomplete environment-variable sanitizer in the system.run function. The sanitizer fails to block critical variables including GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS. An attacker w...

CVE-2026-101884 OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GITCONFIG, DOTNETSTARTUPHOOKS, and JAVATOOLOPTIONS variables. Attackers with gateway or agent access can supply these variables to allowlisted tools like git, dotnet, or...

CVE-2026-101882

OpenClaw Windows Node versions prior to 2026.7.1 are vulnerable to Remote Code Execution (RCE) due to an incomplete validation flaw in the system.execApprovals.set function. The vulnerability allows remote callers to bypass security by adding broad allow rules that accept wildcard-executable rule...

CVE-2026-95339

A flaw was found in chromium-browser. A use-after-free vulnerability in the ServiceWorker component allows a remote attacker to execute arbitrary code outside the application's security sandbox. By convincing a victim to load a specially crafted HTML page, the attacker can exploit improper memory...

CVE-2026-95331

A flaw was found in chromium-browser. An out-of-bounds write vulnerability in the Almost Native Graphics Layer Engine ANGLE component may allow a remote attacker to execute arbitrary code outside the browser sandbox. By convincing a user to visit a specially crafted web page, an attacker can...

CLEANSTART-2025-OK96384 remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'

Security vulnerability affects the git package. A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'...

CVE-2026-55094

Taskcluster, a task execution framework used by Mozilla, is vulnerable to unauthenticated remote code execution (RCE) in versions prior to 100.3.0 . The vulnerability exists in the web-server component when an anonymous role is present that exposes the GraphQL endpoint . Specifically, the applica...

CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)

Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...

CVE-2026-102489

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions...

CVE-2026-55107 Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts LLM-generated code, user formulas, student submissions, third-party plugins in-process without giving them access to host memory, files, network, or credentials. Fr...

EUVD-2026-90080

Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions...

CVE-2026-102489

Zammad versions 6.3.0 to 6.5.4 are vulnerable to a session hijack vulnerability that can lead to remote code execution as the zammad user. While the vulnerability also exists in versions 7.0.0 to 7.1.3 , it is considered not exploitable due to specific environment conditions. No specific remediat...