263244 matches found
Security Bulletin: IBM Db2 and IBM Java SDK used by IBM Security Verify Governance contain multiple vulnerabilities
Summary IBM Security Verify Governance ISVG, now re-branded as IBM Verify Identity Governance IVIG, uses IBM Db2 database and IBM Java SDK. Information about security vulnerabilities affecting IBM Db2 and IBM Java SDK has been published in security bulletins. Vulnerability Details Refer to the...
CVE-2026-53790
A command injection vulnerability in rsync allows remote attackers to execute arbitrary commands by supplying shell metacharacters or newlines in unsanitized inputs, such as hostnames or hostspecs. This impacts multiple vectors—including the RSYNCCONNECTPROG variable, daemon hooks, rsync-ssl, and...
CVE-2026-63046
Apache InLong (versions 2.0.0 through before 2.4.0) is affected by an argument injection vulnerability in the Agent Installer's ModuleManager component. The root cause is that ExcuteLinux.exeCmd() executes arbitrary shell commands with no filtering or whitelist validation , allowing an authentica...
CVE-2026-63046 Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials
Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...
CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...
Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Update: The story was updated after publication to note that the vulnerability has not been exploited. Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No"...
CVE-2026-18781 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...
MAL-2026-14346 Malicious code in @next-fonts/font (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...
Malicious code in mcq-session (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b On any require/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico a path escaping the...
Malicious code in express-session-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...
Malicious code in chai-as-soul (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...
CVE-2026-77650
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
CVE-2026-77651
The arrayref crate 0.3.10 for Rust pulls in a rogue build-time dependency (arrayref-proc-macro1) that executes malicious code at compile time, registering with a C2 server to enable arbitrary code execution. The crate was unpublished from crates.io. Details: https://blog.rust-lang.org/2026/08/20/...
EUVD-2026-63779
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
SUSE CVE-2026-76034
Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
SUSE CVE-2026-76035
Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
EUVD-2026-63757
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...
EUVD-2026-63755
A critical remote code execution RCE vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data...