CVE-2025-26790

Withsecure Atlant with Capricorn engine before 2025-01-2002 allows a Remote Denial of Service via an out-of-bounds memory read during processing of a document file by the antivirus engine...

PT-2026-91424

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An improper configuration of the XSLT Extensible Stylesheet Language Transformations transformation engine allows a remote authenticated attacker to execute arbitrary code...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Adobe Commerce

StyleSmuggler HTTP PoC Private research repository for the HT...

[SECURITY] [DSA 6496-1] nginx security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6496-1 [email protected] https://www.debian.org/security/ Aron Xu September 12, 2026 https://www.debian.org/security/faq -...

Debian dsa-6496 : libnginx-mod-http-geoip - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6496 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6496-1 [email protected] https://www.debian.org/securit...

[SECURITY] Fedora 45 Update: corosync-3.1.10-8.fc45

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

CVE-2026-9160 CSTI in Arma Digital's Website Template

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-9160 CSTI in Arma Digital's Website Template

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-87123

hbs is an Express view engine wrapper for Handlebars. In version 4.3.0 , an unhandled TypeError is thrown during output escaping when an async helper (registered via registerAsyncHelper) resolves to an object whose toHTML property is truthy but not callable. Because the async substitution execute...

EUVD-2026-76029

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

...

Chromium CVE-2026-87536: Use after free in V8

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

...

China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

A China-linked hacking group exploited a flaw in Sogou Input Method , one of the most widely used tools for typing Chinese characters on Windows, to install a backdoor on victims' computers, security company Gen Digital said in research published Thursday. The attack started with a crafted link a...

[SECURITY] Fedora 43 Update: corosync-3.1.10-3.fc43

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

CVE-2026-19486: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

PT-2026-89808

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

Debian dsa-6495 : spip - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6495 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6495-1 [email protected] https://www.debian.org/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-57222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 an...

CVE-2026-9160: Improper Neutralization of Special Elements Used in a Template Engine

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...