CVE-2026-75357: Improper Control of Generation of Code

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2026-58474

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

EUVD-2026-66642

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-58474 whichllm < 0.5.16 Code Injection via run and snippet commands

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

CVE-2026-79132

A flaw was found in Google Chrome on Android. This improper input validation vulnerability allows a remote attacker, who has already compromised the renderer process, to potentially execute arbitrary code outside of the browser's security sandbox. This exploitation occurs when the attacker provid...

CVE-2026-14680

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments. Mitigation Restrict PostgreSQL to trusted hosts and bind only the required interfaces; use pghba.conf...

CVE-2026-75062

Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...

CVE-2026-79047

An use after free flaw was found in the Views component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517515945...

CVE-2026-79027

A flaw was found in WebRTC. A remote attacker could exploit a use-after-free vulnerability by sending crafted network traffic. This could allow the attacker to execute arbitrary code within the sandbox environment, leading to potential system compromise...

CVE-2026-79019

A flaw was found in ANGLE, a graphics abstraction layer used in Chromium-based browsers. A remote attacker could exploit an out-of-bounds write vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside...

CVE-2026-78900

A flaw was found in Chromium's Media component. Improper input validation allows a remote attacker to craft a malicious HTML page. When processed, this page can lead to arbitrary code execution outside the browser's security sandbox, potentially compromising the user's system...

CVE-2026-79235

A flaw was found in WebGL within Chromium. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution outside of the browser's security sandbox...

CVE-2026-79218

An incorrect authorization flaw was found in the Sandbox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500311587...

CVE-2026-79189

A flaw was found in ANGLE, a component used in chromium-browser. A remote attacker could exploit an out-of-bounds write vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially lead to the execution of arbitrary code outside of the browser's security sandbox...

CVE-2026-79149

A flaw was found in ANGLE, a component used in Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside of the sandbox by tricking a user into visiting a specially crafted HTML page. This could lead to a complete compromise of the affected system...

CVE-2026-79127

A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds write vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to execute arbitrary code outside of the browser's security sandbox, leading to a compromise of...

CVE-2026-79073

A flaw was found in the Parser component of Google Chrome. This vulnerability, caused by improper state validation, allows a remote attacker to potentially execute arbitrary code within the browser's security sandbox. Exploitation occurs when a user visits a specially crafted HTML page. This coul...

ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter

A flaw was found in FFmpeg. A remote attacker can exploit a heap out-of-bounds write vulnerability within the vfhqdn3d filter by providing a specially crafted video file. When filtergraph reinitialization is disabled, the filter allocates undersized memory buffers for video frames. Subsequent...