CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

CVE-2026-72589

An OS command injection vulnerability affects alseambusher/crontab-ui up to version 0.4.2. An unauthenticated remote attacker can trigger arbitrary system commands by importing a crafted crontab database file via POST /import, which accepts arbitrary .db files and overwrites the application datab...

CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

VMware - SDK Directory Traversal Detection (CVE-2009-3733)

Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port.""" import re from kittysploit import from...

Firefox Thunderbird DOM DoS

Vulnerability of the DOM component: The Core and HTML components of the Firefox web browser and Thunderbird email client are vulnerable due to improper restrictions on the visible layers of the user interface. Exploiting this vulnerability can allow a remote attacker to cause service interruption...

Firefox Popup Blocker Thunderbird Data Compromise

The vulnerability of the Popup Blocker component in the Firefox web browser and Thunderbird email client is related to the false representation of critical information to the user interface. Exploiting this vulnerability could allow a malicious actor to compromise data integrity remotely...

PT-2026-80024

TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.2...

CVE-2026-72590: Improper Neutralization of CRLF Sequences

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

PT-2026-69474

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3 Description An OS command injection flaw allows an unauthenticated remote attacker to inject arbitrary cron job entries. This occurs when a crafted GET request is sent to the '/crontab' endpoint...

PT-2026-69473

Name of the Vulnerable Software and Affected Versions alseambusher/crontab-ui versions prior to 0.4.3 Description An OS command injection allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The 'POST /import' endpoint accept...

Widget Component DoS

The vulnerability of the Widget component: The Firefox web browser and Thunderbird email client have a vulnerability related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-80046

TuxCare rebuilt swagger-ui-dist to address 2 CVEs. Fixed in 3.52.5-tuxcare.1...

CVE-2026-72589: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

agama-web-ui-23+75.1a877fb50-50.1 on GA media (moderate)

agama-web-ui-23+75.1a877fb50-50.1 on GA media Announcement ID: openSUSE-SU-2026:11472-1 Rating: moderate Cross-References: CVE-2026-13311 CVSS scores: CVE-2026-13311 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-13311 SUSE : 8.7...

CVE-2026-17011 Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpoints, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide on the front end, enabling defacement, content hiding, and UI redressing...

EUVD-2026-54864

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

PT-2026-69267

Name of the Vulnerable Software and Affected Versions Nexter Blocks versions prior to 5.0.2 Description Insufficient access control in a REST endpoint allows users with the Contributor role or higher to save arbitrary global CSS. This stored CSS is rendered site-wide on the front end, which can...

PT-2026-76398

These are all security issues fixed in the agama-web-ui-23+75.1a877fb50-50.1 package on the GA media of openSUSE Tumbleweed...

GHSA-6HR6-W5QG-QMWG vulnerabilities

Vulnerabilities for packages: mitmproxy, open-webui, airflow...

CVE-2026-19270 Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...