Base de CVEs

CVE-2026-44887 Crítica · 9.8 CWE-94 27/05/2026

Leiweibau Pi.Alert - Injeção de código não autenticada no editor de configuração (RCE)

Pi.Alert é um detector de intrusos WIFI / LAN com monitoramento de serviços web. Antes de 2026-05-07, o editor de configuração baseado na web do Pi.Alert permite que código Python arbitrário seja injetado em pialert.conf. Como o daemon de varredura em segundo plano carrega este arquivo via exec() do Python, o código injetado é executado como o processo do daemon. Com a proteção web desabilitada (a configuração padrão), nenhuma autenticação é necessária, tornando esta uma vulnerabilidade de Execução Remota de Código não autenticada. Esta vulnerabilidade é corrigida em 2026-05-07.

CVE-2026-42879 Média · 6.3 CWE-94 27/05/2026

FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authenticated unrestricted file upload vulnerability exists in FacturaScripts' product image upload functionality. An attacker with valid credentials can upload a PHP file disguised as a GIF image (using a GIF89a header), bypassing MIME type validation. The file is stored with its original extension, including executable extensions such as .php. The vulnerability exists the addImageAction() method of Core/Lib/ExtendedController/ProductImagesTrait.php.

CVE-2026-45719 Média · 6.5 CWE-94 27/05/2026

Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

Budibase is an open-source low-code platform. Prior to 3.38.1, the V1 Views API (POST /api/views) accepts a calculation parameter from the request body that is interpolated directly into a CouchDB reduce function definition without validation. Although an internal SCHEMA_MAP object defines the valid calculation types (sum, count, stats), no actual validation is performed against this map before the value is used in string interpolation. A user with Builder permissions can inject arbitrary JavaScript code that will be executed within the CouchDB JavaScript engine when the view is queried. This vulnerability is fixed in 3.38.1.

CVE-2026-37713 Alta · 7.3 CWE-94 27/05/2026

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a…

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/class/commonobject.class.php.

CVE-2026-37712 Alta · 7.3 CWE-94 27/05/2026

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a…

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, call_user_func_array() in function job type

CVE-2026-37711 Alta · 7.3 CWE-94 27/05/2026

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a…

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php

CVE-2026-8832 Alta · 8.8 CWE-94 27/05/2026

WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost

The WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.3.5 This is due to the 'wpcode' custom post type being registered without a custom capability_type or capability restrictions in the wpcode_register_post_type() function, allowing WordPress core to fall back to standard post capabilities for all creation paths including XML-RPC. This makes it possible for authenticated attackers, with author-level access and above, to create and publish executable PHP snippet posts via XML-RPC wp.newPost, which are then executed server-side via eval() in the run_eval() function when the snippet is rendered through the [wpcode] shortcode.

CVE-2026-6169 Alta · 7.2 CWE-94 27/05/2026

affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution

The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.

CVE-2026-9170 Crítica · 9.8 CWE-94 26/05/2026

IBM HTTP Server is affected by multiple vulnerabilities

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation.

CVE-2026-8855 Crítica · 9.8 CWE-94 26/05/2026

IBM HTTP Server: execução remota de código e negação de serviço com autenticação de cliente TLS

O IBM HTTP Server 8.5 e 9.0 é vulnerável a execução remota de código e negação de serviço em configurações com autenticação mútua TLS (autenticação de cliente).

CVE-2026-8633 Crítica · 9.8 CWE-94 26/05/2026

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins

IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request.

CVE-2026-44728 Alta · 7.8 CWE-94 26/05/2026

Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs

Babel is a compiler for writing next generation JavaScript. From 7.12.0 to before 7.29.4 and 8.0.0-alpha.13, using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code. This vulnerability is fixed in 7.29.4 and 8.0.0-alpha.13.

CVE-2026-42785 Alta · 7.2 CWE-94 26/05/2026

OpenKM 6.3.12 Remote Code Execution via Administrative Scripting

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.

CVE-2026-24937 Alta · 7.2 CWE-94 25/05/2026

WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Broadcast Live Video: from n/a before 7.1.3.

CVE-2018-25357 Crítica · 9.8 CWE-94 23/05/2026

Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

CVE-2026-41149 Média · 5.3 CWE-94 22/05/2026

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

CVE-2026-41148 Média · 5.3 CWE-94 22/05/2026

Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in addition to 11.0.0-alpha.1 through 11.12.0 are vulnerable to CSS injection through improper sanitization. The state diagram (and any other diagram type that routes user-controlled style strings through the createCssStyles parser) captures classDef values using an unrestricted regex that matches everything up to a newline. That value then flows unsanitized through addStyleClass() into createCssStyles() and is assigned to style.innerHTML, so a closing brace (}) in the value terminates the generated CSS selector and turns everything after it into a new CSS rule on the page. This enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration. This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.

CVE-2026-9264 Crítica · 9.3 CWE-94 21/05/2026

Cross-Site Scripting em Dynamic Components do Trimble SketchUp (CVE-2026-9264)

Uma vulnerabilidade de cross-site scripting (XSS) no recurso Dynamic Components do SketchUp 2026 permite execução remota de código e exfiltração de arquivos locais por meio de arquivos SKP maliciosamente elaborados. A vulnerabilidade decorre de sanitização inadequada de entradas na janela de opções do componente, permitindo que atacantes executem comandos arbitrários no sistema e leiam arquivos locais sem interação do usuário, explorando um navegador Internet Explorer 11 embutido.

CVE-2026-42396 Média · 6.5 CWE-94 21/05/2026

Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail

CVE-2026-8467 Crítica · 9.5 CWE-94 20/05/2026

phoenix_storybook: injeção de código não autenticada (RCE) via template HEEx no playground

Vulnerabilidade de injeção de código no phoenix_storybook da phenixdigital permite execução remota de código não autenticada via interpolação de valores de atributos não sanitizados na geração de templates HEEx. O manipulador de evento WebSocket psb-assign em 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 aceita nomes e valores arbitrários de atributos provenientes de clientes não autenticados. Esses valores são repassados a 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3, que os armazena sem alterações. Na renderização, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpola valores binários de atributos diretamente em uma string de template HEEx no formato name="<val>", sem escapar aspas duplas nem delimitadores de expressão HEEx. Um invasor pode fornecer um valor contendo uma aspa de fechamento seguida de um bloco de expressão HEEx (por exemplo, foo" injected={EXPR} bar="), fazendo com que EXPR seja tratado como uma expressão Elixir inline. O template resultante é compilado via EEx.compile_string/2 e executado via Code.eval_quoted_with_env/3 com importações completas do Kernel e sem sandbox, concedendo ao invasor execução arbitrária de código no servidor. O problema afeta o phoenix_storybook da versão 0.5.0 até antes da 1.1.0.

CVE-2026-30117 Crítica · 9.8 CWE-94 19/05/2026

scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in…

scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint. This vulnerability allows attackers to execute arbitrary code via uploading a crafted SVG file.

CVE-2026-2586 Crítica · 9.1 CWE-94 19/05/2026

Execução Remota de Código Autenticada por Injeção no Console de Administração do Eclipse GlassFish (CVE-2026-2586)

Foi identificada uma vulnerabilidade de Execução Remota de Código (RCE) autenticada no Console de Administração do GlassFish. Um usuário com acesso ao painel pode enviar requisições elaboradas que permitem a execução de comandos arbitrários do sistema operacional com os privilégios do usuário de serviço da aplicação. Este problema afeta o Eclipse GlassFish: de 8.0.0 até 8.0.1, corrigido em 8.0.2; 7.1.0, corrigido em 7.1.1; de 7.0.0 até 7.0.25, corrigido em 7.0.26. O impacto nas versões de 5.1.0 a 6.2.5 é desconhecido.

CVE-2025-51427 Alta · 7.3 CWE-94 19/05/2026

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary…

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].

CVE-2026-46586 Alta · 8.8 CWE-94 19/05/2026

Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVE-2026-35086 Média · 6.5 CWE-94 19/05/2026

Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services

Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.