Chatchat-Space Langchain-Chatchat Authorization Issue Vulnerability

Chatchat-Space Langchain-Chatchat 0.3.1.3 and earlier versions have an authorization issue vulnerability. This vulnerability arises from the POST /tools/call API endpoint, which allows arbitrary registered tools to be called without authentication. This enables remote attackers to execute arbitra...

Apache CouchDB command injection vulnerability

Apache CouchDB versions 3.5.2 and earlier contain a command injection vulnerability. This vulnerability stems from the lack of validation of runtime configuration values, potentially allowing CouchDB server administrators to execute arbitrary shell commands as users of the CouchDB operating syste...

JD JoySafeter: Vulnerabilities in permission management and access control mechanisms

JD JoySafeter versions 1.0.0 and earlier have vulnerabilities related to permission licensing and access control. These vulnerabilities arise from the execute tool in Copilot’s standard mode not implementing sandbox isolation. After authenticated users select the standard mode in the WebSocket...

Nokia 1830 Global Express security vulnerabilities

The Nokia 1830 Global Express G42, GX G31, GX G32, and GX G34 models prior to the GX r9.0 version have security vulnerabilities. These vulnerabilities stem from bypassing CLI ACLs. Low-privilege authenticated attackers can circumvent the SSH isolation mechanism through custom SSH commands, thereb...

CVE-2026-112263

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263 Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

EUVD-2026-104310

Television tv 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the...

CVE-2026-112263

The Television (tv) application, versions 0.15.0 through 0.15.9 , is vulnerable to OS command injection due to improperly escaped single quotes in the format_command function. An attacker can exploit this by planting a file with a crafted name containing an apostrophe; subsequently, triggering an...

Exploit for Improper Neutralization of Wildcards or Matching Symbols in Laravel Framework

🔐 Penetration Testing su Piattaforma Gestionale Laravel Penetr...

CVE-2026-111406

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-112161

MobaXterm Personal Edition Portable 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it with a malicious library. When the victim opens a Local Shell...

EUVD-2026-104131

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111406

The MapSVG WordPress plugin (versions

CVE-2026-111406 WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

MSC-2026-12903

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

php-lfi

LFI Exploit and Mitigate LFI/RFI Attacks...

Malicious code in fabdeploycheck (PyPI)

Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.json using ssl.createunverifiedcontext and dispatches...