269905 matches found
EUVD-2026-63381
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...
CVE-2026-44725 EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...
CVE-2026-64966
ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...
CVE-2026-64960
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
Azure Data Manager for Energy Remote Code Execution Vulnerability
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network...
Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...
Microsoft Entra ID Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
On July 24th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with an estimated 6,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
EUVD-2026-63367
ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...
CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor
ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...
CVE-2026-64966
ATutor (a learning management system) is affected by a Path Traversal vulnerability in its ZIP extraction functionality. An attacker with instructor privileges can upload a specially crafted ZIP archive that writes files outside the intended extraction directory, enabling placement of a server-ex...
CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor
ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...
CVE-2026-64960
ATutor (version 2.2.4 confirmed) contains a remote code execution vulnerability in the Gameme module due to unrestricted file uploads. Uploaded files are stored in a web-accessible location before content validation, allowing an authenticated attacker to upload a server-executable script and trig...
CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
EUVD-2026-63360
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...
MINI-78J4-2M23-XQ2F
Bulletin has no description...
Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
A now-patched security flaw impacting Zimbra Collaboration ZCS has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team CERT Polska. The vulnerability in question is CVE-2026-73570 CVSS score: 8.9, which refers to a case of command injection that ca...
MAL-2026-14318 Malicious code in frenchworldcupwin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f28b41919d402aff87ec13d36b2419e4c19dcc209dcb6ffa3e736de5be2803e6 package.json declares its sole runtime dependency client-marker-packet-cluster as an arbitrary HTTPS tarball URL on a non-registry host...
