234679 matches found
FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files
A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...
Sandbox Bypass
Apache Syncope is vulnerable to a Sandbox bypass. The vulnerability is due to improper isolation of the Groovy security sandbox, where an administrator with sufficient entitlements can create a malicious Groovy class containing untrusted code, and attackers can bypass the sandbox to execute...
K000163170: Mbed TLS vulnerability CVE-2026-34877
Security Advisory Description An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary...
Malicious code in vitest-cli-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...
SUSE CVE-2026-84202
ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...
EUVD-2026-69748
Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
EUVD-2026-69734
Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.
The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to writing beyond the buffer limit. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the sandbox by using a specially created HTML page...
The vulnerability of the Workers mechanism in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.
The vulnerability of the Workers mechanism in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the analyse_resultat_skel() function in the SPIP content management system allows a hacker to execute arbitrary code.
The vulnerability of the analyseresultatskel function in the SPIP content management system is related to improper handling of code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the Skia component in Google Chrome browser allows a hacker to execute arbitrary code.
The vulnerability of the Skia component in Google Chrome’s browser is related to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Important: perl-DBI security update
DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: perl-DBI: perl-DBI: Hea...
CVE-2026-84349: Use After Free
Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-84324: Use After Free
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...
PT-2026-84865
Name of the Vulnerable Software and Affected Versions Windows ML CLI versions prior to 0.4.0 Description The src/winml/modelkit/serve/cli api.py component exposes commands through a localhost HTTP API without authentication and uses a wildcard for the allow origins setting. This allows a maliciou...
CVE-2026-84452: Permissive Cross-domain Policy with Untrusted Domains
Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...
CVE-2026-84350: Use After Free
Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Low...
CVE-2026-84670: Deserialization of Untrusted Data
Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows a perpetrator to execute arbitrary code.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to a data protection mechanism flaw. Exploiting this vulnerability allows an attacker to execute arbitrary code through a specially created HTML page from a remote location...
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code within the sandbox.
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code within the browser’s sandbox environment, through the use ...