Tue, Sep 22 · 06:17 PM CDTCVE-2026-75699
10.0/10 · Must read/watchNVDvuln
Summary
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require use
CVECVE-2026-75699
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 22 · 06:17 PM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2026-82013
9.9/10 · Must read/watchNVDvuln
Summary
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is chang
CVECVE-2026-82013
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 22 · 06:17 PM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2026-89276
9.9/10 · Must read/watchNVDvuln
Summary
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does n
CVECVE-2026-89276
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 22 · 06:17 PM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2026-92957
9.9/10 · Must read/watchNVDvuln
Summary
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonic
CVECVE-2026-92957
SeverityCRITICAL
TypeUPDATED
PublishedThu, Sep 17 · 02:18 PM CDT
ModifiedSat, Sep 26 · 02:17 PM CDT
CVE-2023-49899
9.8/10 · Must read/watchNVDvuln
Summary
An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.
CVECVE-2023-49899
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 16 · 11:16 AM CDT
ModifiedSat, Sep 26 · 11:10 PM CDT
CVE-2023-49900
9.8/10 · Must read/watchNVDvuln
Summary
An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.
CVECVE-2023-49900
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 16 · 11:16 AM CDT
ModifiedSat, Sep 26 · 11:10 PM CDT
CVE-2024-32641
9.8/10 · Must read/watchNVDvuln
Summary
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicConten
CVECVE-2024-32641
SeverityCRITICAL
TypeUPDATED
PublishedWed, Dec 03 · 05:15 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-27708
9.6/10 · Must read/watchNVDvuln
Summary
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter.
CVECVE-2024-27708
SeverityCRITICAL
TypeUPDATED
PublishedMon, Dec 22 · 08:15 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-45538
9.6/10 · Must read/watchNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in WebAPI Framework in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to execute arbitrary code via unspecified vectors.
CVECVE-2024-45538
SeverityCRITICAL
TypeUPDATED
PublishedThu, Dec 04 · 03:15 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2026-84388
9.6/10 · Must read/watchNVDvuln
Summary
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome Extension 7.4 all versions may allow attacker to information disclosure via remote unauthenticated attack
CVECVE-2026-84388
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 22 · 03:17 PM CDT
ModifiedSun, Sep 27 · 12:16 AM CDT
CVE-2026-75684
9.3/10 · Must read/watchNVDvuln
Summary
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevate
CVECVE-2026-75684
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 22 · 07:16 PM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2026-80151
9.1/10 · Must read/watchNVDvuln
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as ro
CVECVE-2026-80151
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 22 · 04:18 PM CDT
ModifiedSat, Sep 26 · 02:16 PM CDT
CVE-2026-80152
9.1/10 · Must read/watchNVDvuln
Summary
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as ro
CVECVE-2026-80152
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 22 · 04:18 PM CDT
ModifiedSat, Sep 26 · 02:16 PM CDT
CVE-2026-92289
9.1/10 · Must read/watchNVDvuln
Summary
Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret. With oidcRPMetaDataOptionsRequirePKCE set to 2, the authorization endpoint issues a code even when t
CVECVE-2026-92289
SeverityCRITICAL
TypeUPDATED
PublishedFri, Sep 25 · 01:16 AM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2024-13986
8.8/10 · Worth your timeNVDvuln
Summary
Nagios XI < 2024R1.3.2 contains a remote code execution vulnerability by chaining two flaws: an arbitrary file upload and a path traversal in the Core Config Snapshots interface. The issue arises from insufficient validation of file paths and extensions during MIB upload and snapshot rename operations. Exploitation res
CVECVE-2024-13986
SeverityHIGH
TypeUPDATED
PublishedThu, Aug 28 · 04:15 PM CDT
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-32011
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user.
CVECVE-2024-32011
SeverityHIGH
TypeUPDATED
PublishedTue, Nov 11 · 09:15 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-32642
8.8/10 · Worth your timeNVDvuln
Summary
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
CVECVE-2024-32642
SeverityHIGH
TypeUPDATED
PublishedWed, Dec 03 · 05:15 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-58279
8.8/10 · Worth your timeNVDvuln
Summary
appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to upload malicious PHP files through the filemanager upload endpoint. Attackers can leverage authenticated access to generate a web shell with command execution capabilities by uploading a crafted PHP file
CVECVE-2024-58279
SeverityHIGH
TypeUPDATED
PublishedWed, Dec 10 · 10:16 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-58280
8.8/10 · Worth your timeNVDvuln
Summary
CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server.
CVECVE-2024-58280
SeverityHIGH
TypeUPDATED
PublishedWed, Dec 10 · 10:16 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-58281
8.8/10 · Worth your timeNVDvuln
Summary
Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command execution form to gain system access through the uploaded file.
CVECVE-2024-58281
SeverityHIGH
TypeUPDATED
PublishedWed, Dec 10 · 10:16 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2024-58283
8.8/10 · Worth your timeNVDvuln
Summary
WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder file manager. Attackers can exploit the file upload functionality in the elfinder connector to upload a web shell and execute arbitrary system commands through a u
CVECVE-2024-58283
SeverityHIGH
TypeUPDATED
PublishedWed, Dec 10 · 10:16 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
CVE-2026-80412
8.8/10 · Worth your timeNVDvuln
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.
CVECVE-2026-80412
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 23 · 09:17 PM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2026-81537
8.8/10 · Worth your timeNVDvuln
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection.
CVECVE-2026-81537
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 23 · 10:16 PM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2026-81548
8.8/10 · Worth your timeNVDvuln
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVECVE-2026-81548
SeverityHIGH
TypeUPDATED
PublishedThu, Sep 24 · 03:17 PM CDT
ModifiedSat, Sep 26 · 11:16 PM CDT
CVE-2024-48882
8.6/10 · Worth your timeNVDvuln
Summary
A denial of service vulnerability exists in the Modbus TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted network packet can lead to denial of service. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVECVE-2024-48882
SeverityHIGH
TypeUPDATED
PublishedMon, Dec 01 · 04:15 PM CST
ModifiedSat, Sep 26 · 09:10 PM CDT
