263145 matches found
CVE-2026-53633 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE
Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to u...
CVE-2026-13001
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlovehandlecachefiles' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on t...
CVE-2026-50649 .NET Remote Code Execution Vulnerability
...
CVE-2026-50649
CVE-2026-50649 is a .NET/CLR deserialization vulnerability that allows a local attacker to execute arbitrary code by feeding untrusted data. Affected: .NET/NET Core components; root cause is insecure deserialization. Impact per NCSC: execution of arbitrary code with high severity. Exploitation re...
CVE-2026-50649 .NET Remote Code Execution Vulnerability
...
CVE-2026-50646 .NET Framework Remote Code Execution Vulnerability
...
CVE-2026-50646
CVE-2026-50646 affects the .NET Framework. The vulnerability is a protection mechanism failure that could allow an unauthenticated local attacker to execute code on the affected system (attack vector: LOCAL; privileges required: NONE; user interaction required). The CVSS 3.1 base score is 7.8 (HI...
CVE-2026-50646 .NET Framework Remote Code Execution Vulnerability
...
CVE-2026-47305
Technical details such as affected products, component versions, root cause, and mitigation are not publicly available in the provided documents. Monitor for updates from MSRC and NCSC advisories.
CVE-2026-47305 Visual Studio Remote Code Execution Vulnerability
...
CVE-2026-47305 Visual Studio Remote Code Execution Vulnerability
...
GHSA-XRCF-6JH3-GGVX Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Summary Anyquery's server mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the ATTACH DATABASE command to write arbitrary SQLite databases to any path on the victim's filesystem where the...
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
Summary Anyquery's server mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the ATTACH DATABASE command to write arbitrary SQLite databases to any path on the victim's filesystem where the...
EUVD-2026-44072
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...
EUVD-2026-43871
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network...
EUVD-2026-43878
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network...
EUVD-2026-43779
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...
EUVD-2026-43770
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Print Spooler Components allows an authorized attacker to execute code over a network...