CVE-2026-57723: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12...

CVE-2026-54898 Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation

Oj Optimized JSON is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2,Oj::Parserparse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte pointer into the Ruby...

CVE-2026-13967

Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-13834

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-13967

A heap buffer overflow vulnerability exists in the V8 component of Google Chrome (and other Chromium-based browsers like Microsoft Edge) prior to version 150.0.7871.47 . The flaw allows a remote attacker to execute arbitrary code inside a sandbox by interacting with a specially crafted HTML page....

CVE-2026-13883

A Type Confusion vulnerability exists in the ANGLE component of Google Chrome prior to version 150.0.7871.47 . This flaw allows a remote attacker to potentially perform a sandbox escape by navigating to a crafted HTML page. While the Chromium security severity is rated as Medium , the CVSS 3.1 sc...

Malicious code in executor-engine (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of executor-engine were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials an...

PYSEC-2026-589 Malicious code in executor-engine (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of executor-engine were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2934 more potentially affected by CVE-2026-13149 via brace-expansion (>=3.0.0, <=5.0.6)

brace-expansion NPM version =3.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

Linux Distros Unpatched Vulnerability : CVE-2026-0685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server side template inject SSTI in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code...

PT-2026-55186

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of executor-engine were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...

CVE-2026-13772: Use of Externally-Controlled Input to Select Classes or Code

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName and invokes their constructors with no allow-list at three distinct sinks SELECT NEW, enum literals, and reflection-based comparators; an authenticated remo...

PT-2026-53943

Name of the Vulnerable Software and Affected Versions IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.1.6 Description The Object Query Language OQL engine resolves class names provided by an attacker using Class.forName and invokes their constructors without an allow-list at three sinks:...

Cisco Identity Services Engine Software Authorization Vulnerability

Cisco Identity Services Engine Software is a identity management platform developed by the American company Cisco. There are authorization-related vulnerabilities in Cisco Identity Services Engine Software. These vulnerabilities stem from improper authorization checks during resource access...

mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

GCP Compute SSH Pivot via Metadata

Pivot to a VM by injecting an SSH key into Compute metadata and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via...