🚨 CVE-2026-30631
An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`.
🎖@cveNotify
An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`.
🎖@cveNotify
Gist
bytebot RCE description
bytebot RCE description. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-30633
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools.
🎖@cveNotify
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools.
🎖@cveNotify
Gist
knowns_get_update_doc_poc.md
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-52469
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
🎖@cveNotify
GitHub
CVE/Crocus/SQL Injection-1.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52470
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
🎖@cveNotify
GitHub
CVE/Crocus/SQL Injection-2.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52472
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
🎖@cveNotify
GitHub
CVE/Wgcloud/SQL-Injection-1.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52474
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
🎖@cveNotify
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
🎖@cveNotify
GitHub
CVE/AiFlowy/Any SpringBean invocation.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52475
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file
🎖@cveNotify
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file
🎖@cveNotify
GitHub
CVE/AiFlowy/Any file upload vulnerability.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52476
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
🎖@cveNotify
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
🎖@cveNotify
GitHub
CVE/AiFlowy/SQL Injection.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-63047
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
🎖@cveNotify
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
🎖@cveNotify
Joomdonation
Events Booking
Events Booking is a Joomla events registration / events manager extension. It allows you to create, display events, handle registration, get paid from registrants via online payment gateways.
🚨 CVE-2026-63048
The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.
🎖@cveNotify
The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.
🎖@cveNotify
JoomlaCK - Extensions et tutoriels Joomla!
Extensions et documentations Joomlack
Téléchargez des extensions pour joomla, modules, plugins, ou composant. Vous pouvez également télécharger des tutoriels et livres pour créer votre template Joom
🚨 CVE-2026-63264
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
🎖@cveNotify
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
🎖@cveNotify
🚨 CVE-2026-57599
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.
🎖@cveNotify
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.
🎖@cveNotify
🚨 CVE-2026-57600
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.
🎖@cveNotify
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.
🎖@cveNotify
🚨 CVE-2026-61390
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
🚨 CVE-2026-61391
There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
🚨 CVE-2026-61392
There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.
🎖@cveNotify
There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.
🎖@cveNotify
🚨 CVE-2026-16232
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
🎖@cveNotify
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
🎖@cveNotify
Checkpoint
sk185169 - CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token
Applies to: Multi-Domain Security Management, Security Management
🚨 CVE-2026-53910
diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.
When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.
An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.
This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815
🎖@cveNotify
diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.
When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.
An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.
This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815
🎖@cveNotify
cert.pl
Vulnerability in GNU diffutils software
Integer Overflow vulnerability (CVE-2026-53910) has been found in GNU diffutils software.
🚨 CVE-2026-62144
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
🎖@cveNotify
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
🎖@cveNotify
Checkpoint
sk185152 - CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation
Applies to: Multi-Domain Security Management, Security Management
🚨 CVE-2026-62145
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
🎖@cveNotify
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
🎖@cveNotify
Checkpoint
sk185153 - CVE-2026-62145 - Local privilege escalation in Gaia Portal
Applies to: Security Gateways, Security Management
🚨 CVE-2026-14985
The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.
🎖@cveNotify
The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.
🎖@cveNotify
kb.cert.org
CERT/CC Vulnerability Note VU#360868
Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability