Export limit exceeded: 10950 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10950 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72819 | 1 Getgrav | 1 Grav | 2026-08-14 | 8.8 High |
| Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution. | ||||
| CVE-2026-18724 | 1 Open-iscsi Project | 1 Open-iscsi | 2026-08-14 | 7.6 High |
| AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Stack Buffer Overflow in idbm_recinfo_config via Malicious iSCSI Target: a crafted SendTargets TargetName can inject an extra configuration line into a persisted node record and later cause a stack buffer overflow when that record is reparsed. Requirements to exploit: An attacker must control an iSCSI target or tamper with SendTargets discovery traffic, return a crafted `TargetName` containing a newline and oversized injected key or value data, have the victim run persistent discovery, and then trigger a later node-record read such as update or login. Component affected: `iscsi-initiator-utils`; `usr/idbm.c:idbm_recinfo_config`, with attacker-controlled input reaching it through SendTargets handling in `usr/discovery.c` and later record serialization in `usr/idbm.c`. Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - 7.5 (HIGH) AV:N - The attacker can supply the malicious data over the network in a SendTargets discovery response. AC:L - The target-name length cap still leaves enough room for a newline plus an overlong injected key; no race or unusual memory state is required. PR:N - No prior access to the initiator is required. UI:R - The victim must run SendTargets discovery that persists records and later read the saved record. S:U - The impact remains within the initiator-side component that parses and stores its own database records. C:L - Memory corruption could expose limited process memory, but confidentiality impact is not demonstrated. I:L - Process memory corruption can affect integrity, but reliable code execution is not established. A:H - The clearest supported outcome is a crash during config parsing. Impact: Moderate. This issue could otherwise resemble an Important remote denial-of-service flaw, but Red Hat rates such issues lower when they are less easily exploited or depend on narrower conditions. Here, exploitation requires a multi-step SendTargets discovery workflow, persistence of the discovered record, and a later reread of that record. The strongest supported outcome is denial of service or other memory corruption, while code execution remains unproven. Embargo: no Reason: The available evidence supports a multi-step, configuration-dependent denial-of-service or memory-corruption issue rather than a demonstrated remote code execution flaw, so embargoed handling does not appear necessary. Acknowledgement: Aisle Research Vulnerability Details: `idbm_recinfo_config()` copies config keys and values into fixed stack buffers without bounds checks: ```c while (*nl && !isspace(c = *nl) && *nl != '=') { *(name+i) = *nl; i+; nl+; } ... while (*nl) { *(value+i) = *nl; i+; nl+; } ``` In this code path, `name` and `value` are 128-byte and 256-byte stack buffers, so an injected key longer than 128 bytes or a value longer than 256 bytes can corrupt stack memory. During SendTargets discovery, attacker-controlled `TargetName` text is copied into the node record and later written back to disk without control-character filtering: ```c strlcpy(rec->name, targetname, TARGET_NAME_MAXLEN); ... if (strlen(info[i].value)) fprintf(f, "%s = %s\n", info[i].name, info[i].value); ``` `process_sendtargets_response()` treats `TargetName=` records as discovery input, and `add_target_record()` accepts names up to `TARGET_NAME_MAXLEN`. That limit is 255 bytes in this package, which is still enough to carry a newline plus a key longer than the 128-byte `name` buffer. A `TargetName` such as `iqn.test\nAAAA...=B` can therefore split the serialized `node.name` entry into two lines and inject a second config line. Persistent SendTargets discovery stores discovered node records unless nonpersistent mode is used, and later discovery update/login or explicit node operations reread those saved records. The 2048-byte line buffer in `idbm_recinfo_config()` does not prevent this because the injected line only needs to exceed 128 bytes for the key or 256 bytes for the value. Based on the available evidence, the supported impact is a crash or other memory corruption during reparsing. Reliable code execution is plausible but not established. Steps to reproduce: 1. Run a malicious SendTargets responder, or intercept discovery traffic, and return a `TargetName` value containing a newline and an oversized injected key, for example `TargetName=iqn.test\nAAAAAAAA...(>=129 chars)=B`. 2. Run SendTargets discovery in its normal persistent mode. The default `iscsiadm -m discovery ...` workflow persists records unless nonpersistent mode is selected. 3. Inspect the saved node record and confirm that it contains both the expected `node.name = ...` line and an injected `AAAA...=B` line. 4. Trigger any operation that rereads the node record, such as discovery update, node update, or login. 5. Observe a crash during parsing. With instrumentation enabled, the overflow should be reported in `idbm_recinfo_config()`. Mitigation: Until a fix is available, avoid persistent SendTargets discovery against untrusted or interceptable networks. Where operationally acceptable, use nonpersistent discovery, and remove node records created from untrusted discovery results before later update or login operations. Proposed Fix: The fix should address both parts of the chain: bound the key and value copies in `idbm_recinfo_config()` and reject control characters in `TargetName` before persistence. ```diff diff --git a/usr/idbm.c b/usr/idbm.c @@ void idbm_recinfo_config(recinfo_t *info, FILE *f) while (*nl && !isspace(c = *nl) && *nl != '=') { *(name+i) = *nl; i+; nl+; } + while (*nl && !isspace(c = *nl) && *nl != '=') { + if (i >= NAME_MAXVAL - 1) { + log_warning("Config file line %d key too long", line_number); + break; + } + name[i++] = *nl++; + } @@ while (*nl) { *(value+i) = *nl; i+; nl+; } + while (*nl) { + if (i >= VALUE_MAXVAL - 1) { + log_warning("Config file line %d value too long", line_number); + break; + } + value[i++] = *nl++; + } diff --git a/usr/discovery.c b/usr/discovery.c @@ static int add_target_record(char *name, char *end, discovery_rec_t *drec, while ((nul < end) && (*nul != '\0')) nul++; + for (char *p = name; p < nul; p++) { + if (*p == '\n' || *p == '\r' || (unsigned char)*p < 0x20) { + log_error("TargetName contains control characters, rejecting"); + return 0; + } + } ``` ------ This report was generated using AI technology. Always review AI-generated content prior to use | ||||
| CVE-2026-49827 | 1 Smewebify | 1 Weberpmesv2 | 2026-08-14 | 9.8 Critical |
| WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818. | ||||
| CVE-2026-73570 | 1 Zimbra | 1 Collaboration | 2026-08-13 | 8.9 High |
| A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. | ||||
| CVE-2026-18669 | 1 Ibm | 1 I | 2026-08-13 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority. | ||||
| CVE-2026-48046 | 1 Truelockmc | 1 Streambert | 2026-08-13 | N/A |
| Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch. | ||||
| CVE-2026-27544 | 2 Quarka, Wordpress | 2 Qa Analytics, Wordpress | 2026-08-13 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | ||||
| CVE-2026-19091 | 2 Paoltaia, Wordpress | 2 Geodirectory – Wp Business Directory Plugin And Classified Listings Directory, Wordpress | 2026-08-13 | 8.1 High |
| The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). By placing post_type=attachment exclusively in the query string to bypass the consistency check, an attacker can convert an auto-draft GeoDirectory listing into a WordPress attachment with attacker-controlled file paths injected into attachment metadata, which the delete_revision handler then dereferences and unlinks without any post-type or path validation. | ||||
| CVE-2025-31114 | 1 Lllyasviel | 1 Fooocus | 2026-08-13 | N/A |
| Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available. | ||||
| CVE-2026-8984 | 1 Autel | 2 Maxicharger Single Charger, Maxicharger Single Charger Firmware | 2026-08-13 | 9.8 Critical |
| Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges. | ||||
| CVE-2026-71471 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 9 Critical |
| A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters. | ||||
| CVE-2026-49819 | 1 Seriousm4x | 1 Upsnap | 2026-08-13 | 9.8 Critical |
| UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue. | ||||
| CVE-2026-66145 | 1 Sonicwall | 1 Gms | 2026-08-13 | 9.1 Critical |
| An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip. | ||||
| CVE-2026-66147 | 1 Sonicwall | 1 Gms | 2026-08-13 | 9.4 Critical |
| An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests. | ||||
| CVE-2026-18391 | 2 Woocommerce, Wordpress | 2 Subscriptions, Wordpress | 2026-08-13 | 9.8 Critical |
| The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies. | ||||
| CVE-2026-72551 | 1 Apioo | 1 Fusio | 2026-08-13 | 8.8 High |
| A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system(), enabling a developer to escape the sandbox and gain OS command execution on the server. An attacker with a Developer-role account can achieve full server compromise. | ||||
| CVE-2026-17061 | 1 Dassault Systèmes | 1 Simulia Execution Engine | 2026-08-13 | 10 Critical |
| A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution. | ||||
| CVE-2026-73032 | 1 Papersgpt | 1 Papersgpt-for-zotero | 2026-08-13 | 9.6 Critical |
| PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data. | ||||
| CVE-2026-13457 | 2 Instawp, Wordpress | 2 Instawp Connect – 1-click Wp Staging & Migration, Wordpress | 2026-08-13 | 7.5 High |
| The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period. | ||||
| CVE-2026-11325 | 1 Cloudflare | 1 Pages-action | 2026-08-13 | 8.8 High |
| Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunset Date The cloudflare/pages-action repository will be removed on 2026-09-18. Consumers must complete migration before 18th September to avoid CI disruption. Affected Versions All published versions of cloudflare/pages-action, including consumers pinned to the v1 moving tag. Patched Versions None. This repository will not receive further updates, including security patches. Resolution / Migration Path Migrate all workflows using cloudflare/pages-action to `cloudflare/wrangler-action` before 2026-09-18. Refer to the wrangler-action README for the equivalent step configuration and migration guidance. Credit Thanks to @agentka99 and @beg1nn3r for reporting their findings via Cloudflare's HackerOne program that informe | ||||