CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

CVE-2026-61523 WebsiteBaker CMS < 2.13.10 Code Injection via Droplets Editor

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

EUVD-2026-52393

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

CVE-2026-67326

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...

thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow

A flaw was found in Apache Thrift C++ bindings. A remote, unauthenticated attacker can exploit a heap-based buffer overflow vulnerability without user interaction. This can lead to arbitrary code execution, allowing the attacker to gain full control over the affected system, compromise data, and...

CVE-2026-39932

CVE-2026-39932 affects OpenEMR 8.2.0, enabling remote code execution through the document category tree component. The vulnerability arises from an unsanitized eval() in CategoryTree (library/classes/Tree.class.php) that executes PHP payloads injected into the categories table. An authenticated a...

CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

EUVD-2026-52345

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-18642

CVE-2026-18642 describes a deserialization of untrusted data vulnerability in TÜBİTAK BİLGEM’s eta-otp-lock (affected: before 1.0.4) that may enable Object Injection. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL attack vector, NO privileges required, but USER INTERACTION is required; confiden...

CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, enabling injection of arbitrary configuration directives (e.g., core.sshCommand) via malicious submodule names during create_submodule or clone_from. This can lead to remote code execution when Git performs SSH op...

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69097 GitPython before 3.1.53 Config Injection via Submodule Names

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

EUVD-2026-52290

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69096

OpenWrt luci-app-dockerman is affected by an OS command injection in the docker_rpc.uc backend after the JS/ucode conversion. The vulnerability arises because the read ACL can expose ubus objects docker.* / docker.container.* and the run_ttyd handler builds a shell command from request-controlled...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-0392

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor XML over TLS but accepts any TLS certificate a permissive TrustManager and ...

DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the executi...

CVE-2026-0392

eParakstītājs 3.0 for Windows prior to 1.10.0 is vulnerable: its auto-update uses an unauthenticated/integrity-free channel. The client fetches an XML update descriptor over TLS while accepting any certificate, with no verification of the descriptor’s digital signature, no Authenticode/signature ...