Prototype Pollution

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object property...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object proper...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via the propertyPath parameter in AccordionMenu.ts, where user-controlled property path segments are applied to an object without validation. An authenticat...

Prototype Pollution

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via Point.setNestedProperty in ts/Core/Series/Point.ts, which splits a dot-separated key path and traverses...

CVE-2026-114053

A flaw was found in vLLM. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution in the server process. By submitting a crafted multimodal request specifying an attacker-controlled code revision, an attacker can cause the application to load and execute...

CVE-2026-78674 Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

CVE-2026-78674

Multiple WSO2 products are vulnerable to Remote Code Execution (RCE) due to insufficient input validation within the BPMN System REST APIs . An authenticated user can submit crafted requests to execute arbitrary commands on the server with the privileges of the product's runtime account. The pote...

CVE-2026-118683

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...

CVE-2026-118683

The MONAI library (versions 1.2.0 before 1.6.1 ) is vulnerable to remote code execution (RCE) within the ConfigWorkflow.__init__ function. The root cause is that the software passes a bundle's configs/logging.conf file to logging.config.fileConfig, which uses eval() to process handler class and a...

CVE-2026-118683 MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...

EUVD-2026-112388

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...

CVE-2026-118683 MONAI 1.2.0 before 1.6.1 Code Execution via bundle configs/logging.conf

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...

Telegram-0-Click-RCE-SECURITY-VULNERABILITY-ANALYSIS-REPORT

🔴 Telegram 0-Click RCE Vulnerability Analysis Report ZDI-CAN-30207 | CVSS 9.8 CRITICAL | Unpatched as of 2026-03-30 Author: Dennis Kim @gameworkerkim Date: March 30, 2026 Contact: [email protected] 📋 Summary Badges 1. Vulnerability Overview Executive Summary This is a zero-click remote code...

checkmk_broccoli2shell

checkmkbroccoli2shell A Checkmk extension that shows, for every Brotli decoder on a Linux host, whether it is affected by Broccoli2Shell - CVE-2026-111497 , an out-of-bounds write in Google's C Brotli decoder that can lead to remote code execution when a program decompresses Brotli data from an...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell — CVE-2026-109618 / CVE-2026-109619 Unauthenticat...

SUSE CVE-2026-118304

Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-118305

Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-118306

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

SUSE CVE-2026-118307

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-118308

Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...