CVE Vulnerabilities - 23 September 2026

Versions 182200 and earlier of ManageEngine Applications Manager can unintentionally include a Google Cloud service‑account private key in the installation package. If someone obtains this key, they c...

The SunEditor web editor (versions before 2.47.11) does not always strip out custom HTML tags, so malicious code can remain in content that the editor saves. When a user later views or interacts with ...

The Device Discovery Service in Fast FAC1203R Gigabit Edition version 2.0.4 can be tricked into overwriting its own memory, which could let an attacker run their own code from anywhere on the network....

In Ansible Automation Platform, copying a workflow job template does not check the groups that run the jobs. A user who can copy a workflow but lacks permission on those groups can end up running jobs...

If a user can create or edit a project, they can supply a specially crafted git URL that tricks the system into executing arbitrary commands on the controller's task pod. This can let an attacker run ...

In Red Hat Ansible Automation Platform, a secret used for provisioning callbacks is shown to users who only have permission to view job templates. Because the system trusts a client-supplied header, a...

In OpenC3 COSMOS versions 5.1.0 through 7.3.0, a regular authenticated user could add files to a writable configuration area that the system later executes as code. This lets the user run their own pr...

Versions of ManageEngine OpManager up to 12.8.709 allow attackers to run their own code through the Notification Profile feature. This could let a malicious user gain control of the system and access ...

The Laravel-Mediable package (versions 7.0.0 through 7.0.1) does not block files with a .pht extension. Because web servers on Debian and Ubuntu treat .pht files as PHP code, an attacker could upload ...

Versions 1.0.0 through 3.0.0 of IBM Concert can mishandle memory, which could let a malicious user cause the program to stop working or run their own code. This risk appears when an attacker can influ...

Versions 1.0.0 to 3.0.0 of IBM Concert can be tricked into executing operating‑system commands supplied by anyone on the network. This could let an attacker run code on the server with the same rights...

Versions of orval earlier than 8.29.0 do not clean the label (operationId) that comes from an OpenAPI description. If someone provides a specially crafted API spec, their JavaScript can be inserted an...

The orval core library (versions before 8.28.0) can be tricked into executing unwanted code when it builds multipart form data. This happens if an attacker places special placeholders in the names of ...

The orval tool that creates code from OpenAPI definitions can insert unescaped text into the Content-Type header. If an attacker supplies a specially crafted API description, the generated code could ...

The @orval/effect part of orval (versions 8.14.0 to 8.28.1) can execute malicious JavaScript that an attacker embeds in an API description. This happens when the tool turns certain default values into...

If you use orval (versions before 8.29.0) to generate TypeScript code from an OpenAPI description, a specially crafted API file can cause the generated code to run unwanted JavaScript when it is loade...

The Socialwall add‑on for Moodle (versions 3.0 to 3.3) can be tricked into executing unwanted commands when it receives specially crafted web requests. This could let a malicious user take control of ...