PT-2026-40263

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 on-premises affected versions not specified Description Improper control of code generation in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network. This is a code injection...

PT-2026-40235

Name of the Vulnerable Software and Affected Versions Microsoft Data Formulator affected versions not specified Description Improper control of code generation in the AI data visualization feature allows an unauthorized attacker to execute code over a network. This issue occurs when uploaded data...

Ivanti Virtual Traffic Manager: Operating System Command Injection Vulnerability

Ivanti Virtual Traffic Manager is a software-based application delivery controller developed by the American company Ivanti. Versions of Ivanti Virtual Traffic Manager prior to 22.9r4 contained an operating system command injection vulnerability. This vulnerability stems from OS command injection...

CVE-2026-31231

The cognee library (versions up to v0.4.0 ) is vulnerable to a critical remote code execution (RCE) flaw in its notebook cell execution API endpoint. The root cause is the use of the unsafe exec() function to run user-provided Python code without any sandboxing , validation , or security controls...

CVE-2026-31230

The Adversarial Robustness Toolbox ART thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component robustnessevaluationfgsmpytorch.py. The script uses the unsafe eval function to parse string values provided via the --clipvalues and --inputshape command-line...

PIXSO Multi-functional Online Image Editor Arbitrary JavaScript Execution

The vulnerability of the multi-functional online image editor in PIXSO’s UI/UX design is related to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

PT-2026-40349

SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attackers to execute arbitrary code in the context of the web server. Attackers can exploit this vulnerability through specific nginx...

DEBIAN-CVE-2026-42046

libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-bounds write heap overflow by supplying a crafted file in the "caca" format. Depending on the build...

CVE-2025-67887

1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privilege...

CVE-2026-8214

A vulnerability was found in Industrial Application Software IAS Canias ERP 8.03. This affects the function doAction of the component RMI Interface. The manipulation of the argument sessionId results in improper authentication. It is possible to launch the attack remotely. The exploit has been ma...

CVE-2026-35157

Dell ECS 3.8.1.0–3.8.1.7 and Dell ObjectScale

Dell ECS and Dell ObjectScale security vulnerabilities

Dell ECS and Dell ObjectScale are both products of the American company Dell. Dell ECS is an extensible, manageable, and elastic enterprise-level object storage solution. Dell ObjectScale is an object storage platform. There were security vulnerabilities in versions 3.8.1.0 to 3.8.1.7 of Dell ECS...

Cockpit operating system command injection vulnerability

Cockpit is an interactive server management interface developed by Cockpit OpenSource. Cockpit has a vulnerability related to operating system command injection. This vulnerability stems from the lack of cleaning of user-controlled parameters in the system log user interface. This allows remote...

CVE-2026-35157: Improper Neutralization of Formula Elements in a CSV File

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote...

PT-2026-39587

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote...

Grav cross-site scripting vulnerabilities

Grav is a scalable content management system CMS developed by the Grav open-source community, suitable for use in personal blogs, small content publishing platforms, and single-page product displays. Versions of Grav prior to 2.0.0-beta.2 contained a cross-site scripting vulnerability. This...

EUVD-2021-34798

e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading malicious theme files. Attackers can upload a crafted theme package through the theme.php endpoint that deploys a web shell ...

Arbitrary Code Injection

Overview evolutioncms/evolution is an Evolution CMS is a Content Management System, ex MODX Evolution Affected versions of this package are vulnerable to Arbitrary Code Injection via the post parameter in the module creation process. An attacker can execute arbitrary system commands by injecting...

Exploit for Deserialization of Untrusted Data in Cisco Secure_Firewall_Management_Center

🚨 CVE-2026-20131 | Cisco FMC Critical RCE Unauthenticat...

OESA-2026-2266 proftpd security update

ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based...