Security update for vim

This update for vim fixes the following issues: CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service bsc1275018. CVE-2026-73071: use-after-free in JSON decoding can lead to process crash bsc1275017. CVE-2026-73072: heap buffer overflow when loading a spell file...

Security update for vim

This update for vim fixes the following issues: CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service bsc1275018. CVE-2026-73071: use-after-free in JSON decoding can lead to process crash bsc1275017. CVE-2026-73072: heap buffer overflow when loading a spell file...

Security update for vim

This update for vim fixes the following issues: CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service bsc1275018. CVE-2026-73071: use-after-free in JSON decoding can lead to process crash bsc1275017. CVE-2026-73072: heap buffer overflow when loading a spell file...

CVE-2026-77806

SPIP versions before 4.4.21 are vulnerable to unauthenticated remote code execution via a code injection flaw in the analyse_resultat_skel function, which mishandles the X-Spip-Filtre HTTP request header. The vulnerability has been exploited in the wild since August 2026 and is rated CVSS 9.8 (Cr...

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

CVE-2026-18295

A flaw was found in GStreamer. This out-of-bounds write vulnerability occurs during the parsing of MRF files due to improper validation of user-supplied data. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file. Successful exploitatio...

CVE-2026-61400

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are vulnerable to a Command Injection flaw in the run and get diagnostics functionality for system VMs and virtual routers. An authenticated user with the necessary permissions can invoke the getDiagnosticsData or ...

CVE-2026-74554

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. An out-of-bounds write vulnerability exists in the ath12kmacdppeercleanup function. This issue occurs due to incorrect indexing of a bitmap, leading to memory corruption adjacent to the bitmap. This could allow a malicious Wi-Fi peer to...

CVE-2026-74533

A flaw was found in the Bluetooth ISO subsystem of the Linux kernel. This vulnerability is caused by a race condition where certain data is accessed and modified without proper synchronization, leading to a use-after-free UAF error. An attacker could potentially exploit this to execute arbitrary...

CVE-2026-74530

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a Use-After-Free UAF, occurs when a connection is prematurely released while a related synchronization task in hciconnectbigsync is still running. This theoretical flaw could allow an attacker to cause a system crash...

CVE-2026-18781

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

CVE-2026-74531

A flaw was found in the Bluetooth hciconn component of the Linux kernel. A theoretical Use-After-Free UAF vulnerability exists if a connection conn is prematurely freed while the hcisync task is still active. This could potentially allow an attacker to cause a system crash or execute arbitrary...

EUVD-2026-63821

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...

Malicious code in @next-fonts/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...

MAL-2026-14347 Malicious code in mcq-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b On any require/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico a path escaping the...

CVE-2026-77649

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

EUVD-2026-63780

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...