CVE Database

CVE-2026-58569 High · 8.8 CWE-829 Sep 1, 2026

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere…

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges..

CVE-2026-18252 High · 8.1 CWE-829 Aug 26, 2026

Inclusion of Functionality from Untrusted Control Sphere in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

CVE-2026-76139 High · 8.0 CWE-829 Aug 19, 2026

Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.

CVE-2026-73367 High · 7.2 CWE-829 Aug 18, 2026

WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

CVE-2026-49986 High · 7.1 CWE-829 Aug 14, 2026

Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the `open_visualization` tool is invoked, `_find_dev_source()` resolves the user's active project directory as a candidate Cortex source root. The only validation performed by `_is_cortex_root()` is a check for the presence of an `mcp_server/` subdirectory and a `ui/unified-viz.html` file. An attacker who places these two marker files in a malicious repository can cause Cortex to execute an arbitrary `mcp_server/server/visualize_bootstrap.py` from that directory via `subprocess.run([sys.executable, ...])`, achieving code execution with the privileges of the victim's local user process. Version 3.17.1 fixes the issue.

CVE-2026-6464 High · 8.1 CWE-829 Aug 13, 2026

PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-18408 High · 8.8 CWE-829 Aug 13, 2026

PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-71471 Critical · 9.0 CWE-829 Aug 12, 2026

Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters.

CVE-2026-15560 High · 8.1 CWE-829 Aug 11, 2026

Openjdk-orb: unauthed class loading via iiop in eap

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

CVE-2026-66843 Medium · 6.1 CWE-829 Aug 6, 2026

html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

CVE-2026-67623 High · 8.8 CWE-829 Aug 5, 2026

Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim's full privileges when any vibe command is run inside that repository.

CVE-2026-66141 High · 7.8 CWE-829 Jul 24, 2026

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe…

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

CVE-2026-65908 High · 8.6 CWE-829 Jul 23, 2026

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious…

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open

CVE-2026-64811 High · 7.8 CWE-829 Jul 23, 2026

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before…

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

CVE-2026-64809 High · 8.4 CWE-829 Jul 23, 2026

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before…

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

CVE-2026-64808 High · 8.4 CWE-829 Jul 23, 2026

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before…

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

CVE-2026-64807 High · 7.8 CWE-829 Jul 23, 2026

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

CVE-2026-64806 High · 8.4 CWE-829 Jul 23, 2026

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

CVE-2026-64805 High · 8.4 CWE-829 Jul 23, 2026

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

CVE-2026-64804 High · 8.4 CWE-829 Jul 23, 2026

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

CVE-2026-16085 Medium · 5.3 CWE-829 Jul 18, 2026

Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.

CVE-2026-57860 High · 7.8 CWE-829 Jul 17, 2026

ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the forge CLI inside a cloned untrusted repository, the specified commands are spawned with the invoking user's privileges, resulting in arbitrary code execution. This provides a reliable initial-access and persistence primitive against developers who evaluate untrusted repositories with ForgeCode.

CVE-2026-62222 High · 7.8 CWE-829 Jul 16, 2026

OpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-mode

OpenClaw before 2026.5.22 contain a vulnerability in setup-mode discovery that allows loading of untrusted workspace plugins. Attackers with lower-trust caller access or control over configured input paths can execute or persist actions beyond their intended authorization level.

CVE-2026-40501 High · 8.8 CWE-829 Jul 15, 2026

Cherry Studio RCE via SearchService nodeIntegration Misconfiguration

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers who control a search engine provider, individual search result pages, or provider settings pages can execute JavaScript with full Node.js privileges, gaining access to fs, child_process, os, and process.env under the operating-system account of the Cherry Studio process.

CVE-2026-24226 Medium · 6.3 CWE-829 Jul 14, 2026

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause…

NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.