CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

CA Common Services privilege escalation CVE-2016-9795 revisited Description In one of my pentests, I stumbled across the casrvc SUID binary which is part of CA Common Services suite. As I found out, the binary is vulnerable to local privilege escalation. As a matter of fact, a public CVE...

CVE-2026-116576 systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

CVE-2026-116576

The systeminformation library for node.js is vulnerable to Windows command injection in the services() function prior to version 5.33.16 . The root cause is that the sanitizeShellString() function in lib/util.js fails to filter Unicode quotation marks , which PowerShell accepts as string delimite...

CVE-2026-116576 systeminformation: Windows command injection in services() through Unicode quotation marks

systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services in lib/processes.js inserts a caller-supplied service name into a PowerShell Get-CimInstance filter after processing it with sanitizeShellString in lib/util.js. On Windows, the sanitizer removes ASCII...

12,976 Refrigeration Controls Found Exposed Online in 99 Countries

Forescout found 12,976 exposed refrigeration services in 99 countries, warning that attackers could alter temperatures and spoil food, medicines and supplies...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a DoS in Spring Framework (CVE-2026-59282)

Summary IBM Watson Speech Services Cartridge is vulnerable to a DOS, due to an Uncontrolled Resource Consumption in Spring Framework. Spring framework is used in our Speech microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability Details...

DEBIAN-CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-102276 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw exists in GStreamer Editing Services (gst-editing-services) where a GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When loaded by an editing application, media player, or file-manager thumbnailing service (via autoplugging), the pipeline is ...

EUVD-2026-109997

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-115418 SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha

SQL injection in the database-query custom resource handlers in the Amazon Web Services AWS Cloud Development Kit CDK @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuse...

CVE-2026-115418

A SQL injection vulnerability exists in the database-query custom resource handlers within the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module. This flaw affects versions prior to 2.274.0-alpha.0 . An attacker capable of influencing construct property valu...

CVE-2019-6340

Drupal Drupal 8.6.x RCE Exploit exploit CVE: CVE-2019-6340 CMS: Drupal CMS Version: Drupal 8.6.x tested condition: -Drupal 8.6.x, 8.6.10 OR Drupal 8.5.11 -RESTful Web Services module is enabled...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...