274 matches found
CVE-2026-75604
CVE-2026-75604 is an unauthenticated remote code execution vulnerability in Windows-hosted Next.js applications. It requires the coexistence of Pages Router and App Router with Cache Components disabled , a dynamic ISR route, and a closure-bound Server Action where encoded backslashes reach Next....
CVE-2026-52617
CVE-2026-52617 affects the npm package @sworddut/mcp-ffmpeg-helper (all published versions up to 0.2.1 ). The vulnerability is an OS command injection (CWE-78) caused by runFFmpegCommand concatenating MCP tool parameters into a string and passing it to spawn with shell: true. Attacker-controlled ...
CVE-2026-52618
CVE-2026-52618 affects the @webfer/mcp-ansible-drupal npm package (version 2.0.0 ). The root cause is spawn(cmd[0], cmd.slice(1), { shell: true }) in runAnsible.ts, which re-joins an argument array into a single /bin/sh -c string without escaping. An attacker who controls the extraVars value pass...
CVE-2026-52616
CVE-2026-52616 affects the npm package mcp-nmap-server (1.0.1 and earlier, all published versions). The run_nmap_scan MCP tool builds a shell command by string-interpolating the target and additionalFlags parameters and executes it via child_process.exec (/bin/sh -c), enabling OS command injectio...
CVE-2025-42558
CVE-2025-42558 affects Mitel MiCollab and involves a path traversal vulnerability rated High severity. A patch was deployed on 2025-11-01 , per a public repository. The initial CVE entry remains reserved with no NVD description published yet. A public patch/exploit repository is available at gith...
CVE-2024-66001
CVE-2024-66001 affects the Windows Print Spooler and involves a privilege escalation vulnerability rated High severity. A patch was deployed on 2024-11-05 according to a GitHub repository tracking the fix. The CVE entry itself remains in a reserved state in NVD, meaning the CNA has not yet publis...
CVE-2026-02777
CVE-2026-02777 affects Barracuda ESG and involves a remote command injection flaw, rated Critical severity. A patch was deployed on 2026-01-05 , according to a GitHub record at github.com/gduma-phData/patch-CVE-2026-02777 . The NVD listing itself remains a reserved entry with no further public de...
CVE-2026-19843
CVE-2026-19843 affects Cisco IOS XE and involves a privilege escalation via the web UI , rated High severity. A patch was deployed to production on 2026-06-15 and validated by the SecOps Team. The vulnerability is referenced in the CISA Known Exploited Vulnerabilities (KEV) catalog, and a public ...
CVE-2026-06555
CVE-2026-06555 is a path traversal vulnerability affecting SonicWall SMA , rated High severity. According to a public GitHub repository, a patch was deployed to production on 2026-02-25 and validated by the organization's SecOps team. The repository is categorized as an exploit and references CIS...
CVE-2026-09881
Atlassian Confluence is affected by a template injection vulnerability leading to remote code execution (RCE) , rated High severity. A proof-of-concept has been published, as recorded by a CIRCL sighting on 2026-08-24. The vulnerability is referenced in the CISA Known Exploited Vulnerabilities (K...
CVE-2025-37654
CVE-2025-37654 affects Zimbra Collaboration and involves an XSS vulnerability leading to RCE , rated Critical severity. A patch was deployed on 2025-09-22 . An exploit/patch repository is available at github.com/gduma-phData/patch-CVE-2025-37654 , and a sighting was reported via the GithubRedTeam...
CVE-2025-44810
Zoho ManageEngine is affected by a critical remote code execution (RCE) vulnerability via SAML , identified as CVE-2025-44810. A proof-of-concept has been published and is available at https://github.com/gduma-phData/patch-CVE-2025-44810 . According to the available documentation, a patch was dep...
CVE-2026-03200
CVE-2026-03200 affects Progress MOVEit and involves a SQL injection vulnerability rated Critical severity. According to a connected patch document, the fix was deployed to production on 2026-01-15 and validated by a SecOps team. The vulnerability is referenced in connection with the CISA KEV cata...
CVE-2026-04321
CVE-2026-04321 affects Zyxel firewall with an OS command injection vulnerability rated Critical severity. A patch was deployed to production on 2026-01-28 and validated by the SecOps team. The vulnerability is referenced in CISA KEV (Known Exploited Vulnerabilities catalog), indicating it has bee...
CVE-2025-38900
CVE-2025-38900 affects SolarWinds Orion and involves a SQL injection vulnerability rated High severity. A patch was deployed on 2025-10-05 , with the patch status marked as deployed in the associated GitHub repository. No confirmed in-the-wild exploitation details are provided in the available do...
CVE-2024-40275
Technical details for CVE-2024-40275 are not publicly available in the provided documents; the entry is reserved with no product, version, or impact information disclosed. Monitor for future updates from the reserving organization.
CVE-2026-39154
A stored XSS vulnerability (CWE-79) exists in CometChat JS SDK 3.0.12, where the data.text parameter of the /v3.0/messages endpoint is stored and rendered without output encoding, executing attacker-supplied JavaScript in every group member's browser session. The vendor marked it solved. Exploita...
CVE-2024-999999
A proof-of-concept at https://github.com/ForbiddenGarden/CVE-2024-999999-poc demonstrates a heap overflow in the libexample message parser, triggered by a malformed frame with an oversized length prefix, enabling remote code execution . The exploit was tested against libexample 1.2.x on Ubuntu 22...
CVE-2026-31367
CVE-2026-31367 affects EITS Admin Dashboard v2.4.0 and allows unauthenticated Remote Code Execution (RCE) . The root cause is a failure in input sanitization at the /api/v1/debug endpoint, enabling an attacker to inject and execute arbitrary commands on the server via an obfuscated payload. A pub...