CVE-2026-14680

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments. Mitigation Restrict PostgreSQL to trusted hosts and bind only the required interfaces; use pghba.conf...

Malicious code in commonjs-code-token (npm)

Source: amazon-inspector c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned token field directly to eval. Whoever controls that endpoin...

Malicious code in chai-as-org (npm)

Source: amazon-inspector d0dfeeefcb4bd27634dd674f55b10aa10da50d39fc8472afb0f8a11297bce6be The package presents itself as a chai/pino-style utility but its index.js unconditionally requires lib/initializeCaller.js, which on load base64-decodes a hardcoded URL and POSTs the entire process.env of th...

CVE-2026-75062

Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt...

CVE-2026-79047

An use after free flaw was found in the Views component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517515945...

CVE-2026-79019

A flaw was found in ANGLE, a graphics abstraction layer used in Chromium-based browsers. A remote attacker could exploit an out-of-bounds write vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside...

CVE-2026-78900

A flaw was found in Chromium's Media component. Improper input validation allows a remote attacker to craft a malicious HTML page. When processed, this page can lead to arbitrary code execution outside the browser's security sandbox, potentially compromising the user's system...

CVE-2026-79235

A flaw was found in WebGL within Chromium. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution outside of the browser's security sandbox...

CVE-2026-79218

An incorrect authorization flaw was found in the Sandbox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500311587...

CVE-2026-79189

A flaw was found in ANGLE, a component used in chromium-browser. A remote attacker could exploit an out-of-bounds write vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially lead to the execution of arbitrary code outside of the browser's security sandbox...

CVE-2026-79149

A flaw was found in ANGLE, a component used in Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside of the sandbox by tricking a user into visiting a specially crafted HTML page. This could lead to a complete compromise of the affected system...

CVE-2026-79127

A flaw was found in ANGLE in Google Chrome. A remote attacker could exploit an out-of-bounds write vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to execute arbitrary code outside of the browser's security sandbox, leading to a compromise of...

CVE-2026-79073

A flaw was found in the Parser component of Google Chrome. This vulnerability, caused by improper state validation, allows a remote attacker to potentially execute arbitrary code within the browser's security sandbox. Exploitation occurs when a user visits a specially crafted HTML page. This coul...

ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter

A flaw was found in FFmpeg. A remote attacker can exploit a heap out-of-bounds write vulnerability within the vfhqdn3d filter by providing a specially crafted video file. When filtergraph reinitialization is disabled, the filter allocates undersized memory buffers for video frames. Subsequent...

Insecure Automated Optimizations

Overview next is a react framework. Affected versions of this package are vulnerable to Insecure Automated Optimizations through the image-optimizer path in packages/next/src/server/image-optimizer.ts. An attacker can execute code in the server-side image optimization process by supplying an AVIF...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

Important: Red Hat Security Advisory: sqlite security update

An update for sqlite is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

CVE-2026-74851

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

EUVD-2026-66277

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...