ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

Apache Kylin 3.0.1 - Command Injection Vulnerability

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. id: CVE-2020-1956 info: name: Apache Kylin 3.0.1 - Command Injecti...

WordPress File Manager Plugin - Remote Code Execution

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. id: CVE-2020-25213 Uploaded file will be accessible at:-...

Apache OFBiz < 18.12.11 - Remote Code Execution

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery SSRF id: CVE-2023-51467 info: name: Apache OFBiz 18.12.11 - Remote Code Execution author: your3cho severity: critical description: | The vulnerability allows attackers to bypass...

NETGEAR WNAP320 Access Point Firmware - Remote Command Injection

NETGEAR WNAP320 Access Point Firmware version 2.0.3 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2016-1555 info: name: NETGEAR WNAP320 Access Point Firmware - Remote Command Injection author: gy741 severity: critical...

CVE-2026-76801

CVE-2026-76801 affects the FireBox WordPress plugin (WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment) in versions up to and including 3.1.10 . The root cause is a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core funct...

EUVD-2026-74567

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

CVE-2026-76801 FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToR...

CVE-2026-87724

Tor before 0.4.9.12 interprets the CCRESPONSE extension even when CCREQUEST was not sent, which allows remote attackers to cause a denial of service crash because of corrupted congestion-control state. This is TROVE-2026-032...

CVE-2026-87083

A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache.loadkernelfromdisk of the file tilelang/cache/kernelcache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The attack may be performed from remote. This...

CVE-2026-87630

A flaw was found in WebRTC in Chromium-browser. A remote attacker could exploit an integer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to read sensitive memory within the browser's sandbox environment...

CVE-2026-87534

A flaw was found in WebView in Google Chrome. This missing authorization vulnerability allows a remote attacker, by leveraging social engineering techniques, to bypass system access restrictions. This can be achieved through specially crafted network traffic...

CVE-2026-87430

A flaw was found in WebRTC, a real-time communication component, within Google Chrome. A remote attacker could exploit this buffer overflow vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation may allow the attacker to execute arbitrary code within the...

CVE-2026-87429

A flaw was found in the ServiceWorker component of Chromium. A remote attacker, after compromising the renderer process, could exploit a missing authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions...

CVE-2026-87622

A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...

CVE-2026-87586

A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser's security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the...

CVE-2026-87523

A flaw was found in Chromium. A race condition in the DataTransfer component allows a remote attacker, by leveraging social engineering techniques, to obtain sensitive information. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-87623

A flaw was found in Google Chrome. An observable discrepancy in the Document Object Model DOM could be exploited by a remote attacker. By leveraging social engineering techniques and a specially crafted HTML page, an attacker could obtain sensitive user information...

CVE-2026-87593

A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...

CVE-2026-87445

A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to user interface UI elements being spoofed, potentially misleading users and allowing for information disclosure...