Unified CVE Intelligence,
Powered by AI

A critical SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Prem deployments allows authenticated attackers with basic privileges to escalate their privileges and potentially compromise the system.

A high-severity out-of-bounds write vulnerability exists in the Brotli decoder bundled with Node.js. An attacker can exploit this flaw by providing malformed Brotli-compressed data, potentially leading to remote code execution within the Node.js process.

CVE-2026-109618 is a critical remote code execution vulnerability identified in the PHP core. The vulnerability allows an attacker to execute arbitrary code on affected servers. As of the current reporting, no technical details, proof-of-concept exploits, or specific affected configurations have been publicly released, and the vulnerability remains in a reserved status pending an official security advisory from the PHP development team.

CVE-2026-109619 is a reserved identifier for a reported Remote Code Execution vulnerability affecting PHP. As of the current date, no official technical details, vendor advisories, or patches have been released to confirm the nature, scope, or impact of the vulnerability.

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.