CVE-2026-0765

...

CVE-2026-0765 Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability

Open WebUI PIP installfrontmatterrequirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists...

CVE-2026-0755

CVE-2026-0755 affects the gemini-mcp-tool, specifically the execAsync method. The flaw is an OS command injection (CWE-78) caused by insufficient validation of user-supplied input before it is used in a system call, enabling unauthenticated remote code execution. Attackers could run arbitrary cod...

CVE-2025-15061

CVE-2025-15061 affects Framelink Figma MCP Server. The flaw is in the fetchWithRetry method, where a user-supplied string is not properly validated before being used in a system call, enabling remote command execution with the service account’s privileges. Attack requires network access and no au...

CVE-2026-0795

The CVE-2026-0795 entry concerns ALGO 8180 IP Audio Alerter. The vulnerable component is the web-based user interface, where improper validation of a user-supplied string before it is used in a system call enables remote code execution. An attacker must authenticate to exploit this vulnerability,...

CVE-2026-0792

CVE-2026-0792 concerns the ALGO 8180 IP Audio Alerter. The flaw is a stack-based buffer overflow in the handling of the SIP SIP INVITE Alert-Info header, caused by insufficient validation of the length of user-supplied data before copying it into a fixed-length buffer. This can allow remote code ...

CVE-2026-0786 ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability

ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific flaw...

CVE-2026-0784 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific fla...

CVE-2026-0783

CVE-2026-0783 affects ALGO 8180 IP Audio Alerter devices, targeting the web UI. The flaw is insufficient validation of a user-supplied string used in a system call, enabling an attacker to achieve remote code execution within the device context. Reported as a Web UI command injection with authent...

CVE-2026-0781 ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific fla...

CVE-2025-15063 Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability

Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2025-15063

CVE-2025-15063 : Ollama MCP Server contains a command injection in the execAsync method. The flaw stems from insufficient validation of a user-supplied string before it is used to perform a system call, enabling an unauthenticated attacker to execute arbitrary code with the service account contex...

Gitea does not properly validate ownership when toggling OpenID URI visibility

Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility settings of other users' OpenID identities...

The vulnerability of the nfsd_create_setattr() function in the Linux operating system allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the nfsdcreatesetattr function in the Linux operating system is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...

CVE-2026-20750

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization...

CVE-2026-20045

A vulnerability in Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager Session Management Edition Unified CM SME, Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P, Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could...

EUVD-2026-3672

go-tuf is a Go implementation of The Update Framework TUF. Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to...

The vulnerability of the Networking component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, allows attackers to gain access to read, modify, and delete data.

The vulnerability of the Networking component of the Oracle Java SE software platform, as well as the Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain rea...

Weintek cMT security vulnerabilities

Weintek cMT is a human-computer interface application developed by Weintek Corporation. There is a security vulnerability in Weintek cMT. This vulnerability stems from the insufficient validation of inputs that are assumed to be immutable but are actually externally controllable. This could allow...

CVE-2026-20055

Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise Packaged CCE and Cisco Unified Contact Center Enterprise Unified CCE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-base...