Total
7193 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-61523 | 1 Websitebaker | 1 Websitebaker | 2026-08-14 | 7.2 High |
| WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable path inside the modules directory, enabling unauthenticated users to achieve remote code execution by making direct HTTP requests to the written file. | ||||
| CVE-2026-49143 | 1 Browserstack | 2 Browserstack-local, Browserstack-runner | 2026-08-14 | 8.8 High |
| BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication. | ||||
| CVE-2021-47770 | 1 Openplcproject | 2 Openplc, Openplc V3 | 2026-08-14 | 8.8 High |
| OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network connection to a specified IP and port, enabling remote command execution. | ||||
| CVE-2026-72819 | 1 Getgrav | 1 Grav | 2026-08-14 | 8.8 High |
| Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead of string notation, call the unZip routine with a malicious archive, and write PHP files to the web root for execution. | ||||
| CVE-2026-73505 | 1 Jandedobbeleer | 1 Oh-my-posh | 2026-08-14 | 7.8 High |
| Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1. | ||||
| CVE-2026-31230 | 1 Trusted-ai | 1 Adversarial-robustness-toolbox | 2026-08-14 | 9.8 Critical |
| The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py). The script uses the unsafe eval() function to parse string values provided via the --clip_values and --input_shape command-line arguments. This allows an attacker to inject arbitrary Python code into these arguments, which will be executed when eval() is called. The vulnerability can be exploited remotely if an attacker can control these arguments (e.g., through pipeline configuration or automated scripts), leading to arbitrary code execution on the system running the ART evaluation. | ||||
| CVE-2026-61962 | 2 Hakan Ozevin, Wordpress | 2 Wp Base Booking, Wordpress | 2026-08-13 | 10 Critical |
| Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | ||||
| CVE-2026-73649 | 1 Shepherdwind | 1 Velocity.js | 2026-08-13 | 9.8 Critical |
| Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed an attacker-controlled template to traverse constructor.constructor to the JavaScript Function constructor. The #set handler validated only the assignment target and did not inspect the right-hand property-read expression, allowing arbitrary shell commands, environment-variable access, cloud-credential access, and internal-network access in the server process. This issue is fixed in version 2.1.7. | ||||
| CVE-2026-67986 | 2026-08-13 | 8.4 High | ||
| amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names. | ||||
| CVE-2026-73291 | 1 Seerr-team | 1 Seerr | 2026-08-13 | 7.1 High |
| Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart. This issue is fixed in version 3.4.0. | ||||
| CVE-2026-27544 | 2 Quarka, Wordpress | 2 Qa Analytics, Wordpress | 2026-08-13 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | ||||
| CVE-2026-73231 | 1 Faker-js | 1 Faker | 2026-08-13 | 7.8 High |
| Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0. | ||||
| CVE-2026-45618 | 1 Harttle | 1 Liquidjs | 2026-08-13 | 10 Critical |
| LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue. | ||||
| CVE-2026-8984 | 1 Autel | 2 Maxicharger Single Charger, Maxicharger Single Charger Firmware | 2026-08-13 | 9.8 Critical |
| Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges. | ||||
| CVE-2026-66145 | 1 Sonicwall | 1 Gms | 2026-08-13 | 9.1 Critical |
| An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip. | ||||
| CVE-2026-66147 | 1 Sonicwall | 1 Gms | 2026-08-13 | 9.4 Critical |
| An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests. | ||||
| CVE-2026-66148 | 1 Sonicwall | 1 Gms | 2026-08-13 | 6.3 Medium |
| An authenticated command injection vulnerability was identified in GMS Command-Line Interface (CLI) 9.5.1 (Build 9510.1044) and earlier versions which allows low-privileged local user to execute system commands with root privileges. | ||||
| CVE-2026-65941 | 1 Progress Software | 1 Whatsup Gold | 2026-08-13 | 8.8 High |
| In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account. | ||||
| CVE-2026-73032 | 1 Papersgpt | 1 Papersgpt-for-zotero | 2026-08-13 | 9.6 Critical |
| PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero's chrome-privileged context, enabling file read/write, process execution, and access to all Zotero data. | ||||
| CVE-2026-73084 | 1 Activepieces | 1 Activepieces | 2026-08-13 | 6.1 Medium |
| Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0. | ||||