212465 matches found
Sandbox Bypass
Apache Syncope is vulnerable to a Sandbox bypass. The vulnerability is due to improper isolation of the Groovy security sandbox, where an administrator with sufficient entitlements can create a malicious Groovy class containing untrusted code, and attackers can bypass the sandbox to execute...
Malicious code in vitest-cli-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...
EUVD-2026-69748
Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
EUVD-2026-69734
Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
PT-2026-84865
Name of the Vulnerable Software and Affected Versions Windows ML CLI versions prior to 0.4.0 Description The src/winml/modelkit/serve/cli api.py component exposes commands through a localhost HTTP API without authentication and uses a wildcard for the allow origins setting. This allows a maliciou...
The vulnerability of the Workers mechanism in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.
The vulnerability of the Workers mechanism in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.
The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to writing beyond the buffer limit. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the sandbox by using a specially created HTML page...
Important: perl-DBI security update
DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: perl-DBI: perl-DBI: Hea...
Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows a perpetrator to execute arbitrary code.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to a data protection mechanism flaw. Exploiting this vulnerability allows an attacker to execute arbitrary code through a specially created HTML page from a remote location...
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code within the sandbox.
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code within the browser’s sandbox environment, through the use ...
RHEL 7 : freerdp (RHSA-2026:62401)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62401 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...
The vulnerability of the Views component in Google Chrome and Microsoft Edge browsers allows a hacker to execute arbitrary code.
The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code through a specially created HTML page...
CVE-2026-84350
Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Low...
CVE-2026-84335
CVE-2026-84335 is an incorrect authorization vulnerability in the TabStrip component of Google Chrome prior to 152.0.7977.75 . A remote attacker who had already compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a cra...
CVE-2026-84637
A flaw was found in Thunderbird. Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows systems. This bypasses Thunderbird's built-in protections for executable attachments, potentially leading to arbitrary code execution...
EUVD-2026-65525
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers incomplete fix of CVE-2026-12841...
CVE-2026-73776 Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX
A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious actor with administrative privileges to execute arbitrary code on the underlying operating system, when certain pre-conditions outside of th...
GHSA-6HWM-XVPH-95VM NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...