CVE-2026-102454

The EasyFlow .NET software developed by Digiwin is susceptible to an Arbitrary File Upload vulnerability. A privileged remote attacker can exploit this flaw to upload and execute web shell backdoors , which leads to arbitrary code execution on the server. No specific affected versions, root cause...

EUVD-2026-89681

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

USN-8848-1 python-django vulnerabilities

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LT...

CVE-2026-92867

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution...

CVE-2026-92867

An out-of-bounds write vulnerability exists in Pgpool-II , which could allow an authenticated attacker to cause abnormal process termination or achieve arbitrary code execution . While technical details regarding the specific root cause or affected versions are not provided in the documents, the ...

CVE-2026-97977

A flaw was found in the Linux kernel's Bluetooth USB driver. A race condition during device closure or disconnection allows background receive tasks to continue running after the associated device data has been released, leading to a use-after-free UAF condition. A local attacker could exploit th...

CVE-2026-102331

A flaw was found in chromium-browser. This flaw allows a remote attacker to achieve arbitrary code execution outside of the application sandbox via a buffer overflow in the ANGLE Almost Native Graphics Engine component. An attacker could exploit this vulnerability by enticing a user to visit a...

Security Bulletin: This Power System update is being released to address CVE-2026-96263

Summary Power Systems Firmware is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful...

CVE-2026-103111

A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time JIT compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt...

Security Bulletin: This Power System update is being released to address CVE-2026-96264

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

Security Bulletin: This Power System update is being released to address CVE-2026-96262

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be...

CVE-2026-102875

A flaw was found in VLC media player. An attacker can achieve arbitrary code execution by convincing a user to open a maliciously crafted skin archive. Because the theme loader fails to properly validate member file paths within the archive, files containing directory traversal sequences can be...

CVE-2026-103105

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node...

Malicious code in developmentstelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98ef8863222571a8e77635ed5129c41ad9583d9df4e9e5fd61b5a07c4fb26887 package.json declares scripts.postinstall = 'node index.js'. index.js is a 143-byte stub whose only behavior is to dynamically import the sole declar...

Malicious code in booking-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08305a6c73bd94f2983c949316cb78fef7f7169f85523a773c94fb305874e063 The package's package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The bundled 4444.vbs contains...

CVE-2026-97955

A flaw was found in the Microsoft Azure Network Adapter MANA driver in the Linux kernel. A local user with network administrative privileges can cause a denial of service DoS or potentially execute arbitrary code due to a use-after-free vulnerability. When attaching an eXpress Data Path XDP progr...

CVE-2026-103105

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node...

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. id: CVE-2021-44077 info: name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution author: Adam Crosser,gy741...

kernel: netfilter: flowtable: publish GC-visible tuple last

A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...

Malicious code in tailwind-forms-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1083ea1ddf83f29a443e7ba4b24db0d24da35dfd0a9d0ac032ae20501ac57ea npm package [email protected] impersonates the @tailwindcss/forms plugin: the package.json name field is ' tailwind-forms-kit' with a leading...