Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-85475
Alta · 7.2
CWE-96 23/09/2026
A flaw was found in the Ansible Automation Platform automation controller. The external…
A flaw was found in the Ansible Automation Platform automation controller. The
external logging (rsyslog) configuration is generated by interpolating
user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH
and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config
file without neutralizing RainerScript syntax. A privileged (superuser) user can
inject rsyslog directives, including an omprog action, causing arbitrary command
execution inside the control-plane rsyslog component. This allows disclosure of
the controller SECRET_KEY and database credentials, decryption of all stored
credentials, and full compromise of the control plane.
CVE-2026-68489
Alta · 8.7
CWE-96 14/09/2026
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit"…
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
CVE-2026-86218
Crítica · 9.8
KEV Urgente · 82 Exploit público CWE-96 06/09/2026
N-able N-central Static Code Injection Vulnerability
N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
CVE-2025-57707
Alta · 8.8
CWE-96 11/02/2026
File Station 5
An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data / files.
We have already fixed the vulnerability in the following version:
File Station 5 5.5.6.5166 and later
CVE-2025-7825
Média · 6.3
CWE-96 03/10/2025
Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation
The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.