269317 matches found
PT-2026-77349
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description An issue in the Core component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 and IIOP protocols to...
CVE-2026-67920
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...
PT-2026-77917
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows an unauthenticated attacker with network access via SMTP to compromise the system. Successful...
PT-2026-77913
Name of the Vulnerable Software and Affected Versions Oracle Financial Services Enterprise Case Management version 8.0.8.2 Oracle Financial Services Enterprise Case Management version 8.1.2.11 Description A flaw in the Web UI component allows a low privileged attacker with network access via HTTP...
PT-2026-77159
CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlm eval tool. The tool's approval requirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code ...
PT-2026-76973
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 115.39 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to...
PT-2026-77331
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A race condition in the USB component allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox. This is...
PT-2026-77171
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...
Mozilla Firefox < 154.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 154.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-74 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR...
PT-2026-80784
This update for redis fixes the following issues: Changes in redis: - Update to 8.10.1 Update urgency: SECURITY: There are security fixes in the release. - Security fixes - CVE-2026-62356 Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write - Out-of-bounds access in TopK...
CVE-2026-67919
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...
CVE-2026-69146
creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:05+00:00| published-proof-of-concept| https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00|...
CVE-2026-67854
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
The HTTP MCP server-registry backend factory atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by...
CVE-2026-67926
An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module...
CVE-2026-67965
An issue in Tneda W20E v.16.01.0.62782 allows a remote attacker to execute arbitrary code via the urlneedlogin function...
CVE-2026-67925
Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...
CVE-2026-67966
Tenda W20E V16.01.0.62782 /goform/telnet endpoint allows unauthenticated remote attackers to activate the Telnet daemon and obtain root shell access...
DEBIAN-CVE-2026-65640
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...