CVE-2026-94299

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.

In Teltonika Networks RUTOS devices (versions 7.22 through 7.24.2) and TSWOS devices (versions 1.9 through 1.10), an unauthenticated user can directly call LUA functions, bypassing validations that would normally apply to API requests. Because these requests do not follow proper flows, this can lead to OS command execution.

The Gravity Forms plugin for WordPress in versions up to and including 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of List input type. The submitted value is passed to WordPress' unrestricted global maybe_unserialize() instead of the hardened GFCommon::maybe_unserialize(), allowing unauthenticated attackers to inject a PHP object into post meta. If a gadget chain exists via another plugin or theme, this could lead to remote code execution.

Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.

In SOCFortress CoPilot prior to 0.1.76, case-report templates uploaded by the lowest-privilege customer_user role are later executed by non-sandboxed Jinja2 engines when an admin or analyst generates a report. Lack of template content validation and cross-tenant scoping allows an attacker to inject malicious Jinja expressions that are evaluated as Python on the backend.

Docat has an arbitrary file upload vulnerability in its Upload API because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious files on the Docat web server.

ServiceNow remediated a sandbox escape vulnerability in the ServiceNow AI Platform. An authenticated user with the admin role could bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system.