Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-20902)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the map filename field during the map upload action of the parameters route. This plugin only work...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-25109)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the devices field when accessing the get setup route, leading to remote code execution. This plugi...

Copeland XWEB and XWEB Pro Improper Neutralization of Special Elements Used in an OS Command (CVE-2026-21389)

An OS Command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote code execution on the system by injecting malicious input into the request body sent to the contacts import route. This plugin only works with Tenable.ot. Please...

PT-2026-113607

Name of the Vulnerable Software and Affected Versions Collabora Online Built-in CODE Server versions prior to 26.4.303 Description An OS command injection exists in the proxy.php endpoint of the richdocumentscode app. The issue occurs when the CODE server is not running, such as after a restart,...

Linux Distros Unpatched Vulnerability : CVE-2026-110155

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-110151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-110142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...

DHCP Server Windows Code Execution

The vulnerability of DHCP servers for Windows operating systems is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Network Device Enrollment Service Code Execution

The vulnerability of the Network Device Enrollment Service NDES for Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

DHCP Server Windows Code Execution

The vulnerability of DHCP servers for Windows operating systems is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-130068)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130068 advisory. FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce...

PT-2026-113773

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem which in specific conditions could potentially enable a remote authenticated attacker to execute...

Important: hplip security, bug fix, and enhancement update

The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project HPLIP, which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fixes: hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-110153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

VulnCheck KEV: CVE-2026-39949

Cacti ≤ 1.2.30 has an authenticated OS command injection flaw. Users with device and graph template creation privileges can put shell metacharacters in a device’s notes field. Cacti’s variable replacement engine inserts that field, unsanitized, into RRDtool command-line arguments through the...

VulnCheck KEV: CVE-2026-110447

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

Linux Distros Unpatched Vulnerability : CVE-2026-110169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

CVE-2024-21513

CVE-2024-21513 PoC for CVE-2024-21513 Original exploit documented by Snyk Security Research Exploit CVE-2024-21513 is a vulnerability in langchain-experimental where unvalidated SQL query results were passed to Python's eval, enabling remote code execution through SQL-based input injection. PoC...

CVE-2020-5902

CVE-2020-5902 / \ \ / / | | \ / \ \ / \ | / \ / \ \ | | \ \ / /| | | | | | | | | || || | | | | | | | \ / / | |/ /| | | |/ /| | | || \, | | | |/ / | | \ / | | / /| || / /| || | | / /| || / / | / || ||/|/ |/ // /| CVE-2020-5902-Scanner.py @nsflabs The F5 BIG-IP Traffic Management User...

Moniker-Link-CVE-2024-21413-

Moniker-Link-CVE-2024-21413- On February 13th, 2024, Microsoft announced a Microsoft Outlook RCE & credential leak vulnerability with the assigned CVE of CVE-2024-21413 Moniker Link. Haifei Li of Check Point Research is credited with discovering the vulnerability. The vulnerability bypasses...