PT-2026-93804

Name of the Vulnerable Software and Affected Versions ScadaLTS version 2.8.1-release-candidate build 0 Description An authenticated remote code execution issue exists due to a scripting sandbox bypass. The DWR "DataSourceEditDwr" class exposes the validateScript function, which compiles and...

Astra Linux – Vulnerability in Chromium

The use of after-free in V8 in Google Chrome before version 147.0.7727.55 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-18708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed withi...

Redis < 6.2.20 / 7.0.x < 7.2.11 / 7.4.x < 7.4.6 / 8.0.x < 8.0.4 / 8.2.x < 8.2.2 RCE (RediShell)

The version of Redis installed on the remote host is prior to 6.2.20, 7.0.x prior to 7.2.11, 7.4.x prior to 7.4.6, 8.0.x prior to 8.0.4, or 8.2.x prior to 8.2.2. It is, therefore, affected by a vulnerability as referenced in the security advisory. - A use-after-free vulnerability in the Lua...

EUVD-2026-62937

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76372

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-72712

A flaw was found in Nmap. A remote attacker can exploit this denial of service vulnerability by sending a specially crafted packet that includes a zero-length Transmission Control Protocol TCP option. This malformed packet forces the application to enter an infinite loop during packet processing,...

PT-2026-78799

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-18708

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

CVE-2026-65813

creationtimestamp| type| source ---|---|--- 2026-08-11 19:01:06+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-12 01:01:02+00:00| seen| https://www.thezdi.com/blog/2026/8/11/the-august-2026-security-update-review 2026-08-12 12:49:33+00:00| seen|...

CVE-2026-18708

The CVE-2026-18708 issue affects MongoDB Server’s JavaScript scripting engine. An authenticated user with write privileges can cause code they control to run within the query scope of other users via a specially crafted stored value processed during an internal maintenance cycle. This can lead to...

Improper Neutralization of Input in MongoDB Server's JavaScript Scripting Engine Leads to Unauthorized Code Execution Within Query Scopes

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

CVE-2026-18708

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

CVE-2026-18708: Improper Control of Generation of Code

An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could...

Elasticsearch - Groovy Script RCE Detection (CVE-2015-1427)

Detects CVE-2015-1427 by POSTing a Groovy scriptfields payload to /search that executes id via Runtime.exec. !/usr/bin/env python3 -- coding: utf-8 -- """Elasticsearch Groovy scripting engine RCE CVE-2015-1427.""" import re from kittysploit import from lib.protocols.http.httpclient import...

CVE-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

CVE-2026-41171

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery SSRF vulnerability due to missing SSRF protection on the "Jint" HTTP client used by scripting engine functions "getJSON", "request", etc.. An...

CVE-2026-41171

Squidex (open source headless CMS) Versions prior to 7.23.0 are affected by an SSRF vulnerability in the Jint HTTP client used by scripting functions (e.g., getJSON, request). An authenticated user with low privileges can force the server to make arbitrary outbound HTTP requests to attacker-contr...

CVE-2026-33656: Improper Limitation of a Pathname to a Restricted Directory

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the sourceId field on Attachment entities. Because sourceId is...

CVE-2026-41171: Server-Side Request Forgery (SSRF)

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery SSRF vulnerability due to missing SSRF protection on the Jint HTTP client used by scripting engine functions getJSON, request, etc.. An authenticate...