Malicious code in @zalastax/nolb-func (npm)

The package @zalastax/nolb-func was found to contain malicious code. --- Credit: OpenSSF source...

VulnCheck KEV: CVE-2026-38992

Cockpit v2.13.5 and earlier is vulnerable to arbitrary code execution via the filter parameter within multiple endpoints. This vulnerability allows an attacker to run system commands on the underlying infrastructure via the MongoLite $func operator...

CVE-2026-51296

A flaw was found in SQLite. A use-after-free vulnerability in the SQLite JSON module's jsonRemoveFunc allows a remote attacker to cause a denial of service by crashing the service. This vulnerability can also lead to the disclosure of sensitive heap memory information...

eyoucms v.1.6.5 - Cross-Site Scripting Detection

Cross Site Scripting XSS vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """Cross Site Scripting XSS vulnerability in the func parameter in eyoucms v.""" from kittysploit import from...

Malicious code in url-func-registry (npm)

Source: amazon-inspector 3a4d96efb2897a3908596981acd2c0666cfd7445def91a32e02e2f95c9475ecf [email protected] exposes a factory createJsonService registered under key 'JsonS' in the public getFunc API that fetches https://www.jsonkeeper.com/b/XVHGD — an anonymous, publicly-editable,...

CVE-2026-64451 tracing: Fix NULL pointer dereference in func_set_flag()

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences tr-currenttraceflags before verifying that the current tracer is actually the function tracer. When the active tracer has been switched away from...

Linux Distros Unpatched Vulnerability : CVE-2026-64451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing: Fix NULL pointer dereference in funcsetflag funcsetflag dereferences...

MAL-2026-10574 Malicious code in vite-plugin-config-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7 Package name impersonates the widely-used vite-plugin-tsconfig-paths the package.json homepage points to the legitimate plugin's README, and the READ...

PT-2026-59834

Impact An input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.raw ops.PyFunc. python import tensorflow as tf value = tf.constantvalue=1,2 token = b'xb0' dataType = tf.int32 tf.raw ops.PyFuncinput=value,token=token,Tout=dataType Patches We have patched the issue in GitHub...

PYSEC-2026-1927 Skops has Inconsistent Trusted Type Validation that Enables Hidden `operator` Methods Execution

Summary An inconsistency in OperatorFuncNode can be exploited to hide the execution of untrusted operator.xxx methods. This can then be used in a code reuse attack to invoke seemingly safe functions and escalate to arbitrary code execution with minimal and misleading trusted types. Note: This...

CVE-2026-36724: Uncontrolled Resource Consumption

An uncaught exception in the /application/job/update/id endpoint of FastapiAdmin v2.2.0 allows authenticated attackers with the moduletask:job:update permission to cause a Denial of Service DoS via manipulating the func field of scheduled tasks...

CVE-2026-7465

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server...

tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()

...

SUSE CVE-2026-46196

In the Linux kernel, the following vulnerability has been resolved: tracepoint: balance regfunc on funcadd failure in tracepointaddfunc When a tracepoint goes through the 0 - 1 transition, tracepointaddfunc invokes the subsystem's ext-regfunc before attempting to install the new probe via funcadd...

CVE-2026-46196

In the Linux kernel, the following vulnerability has been resolved: tracepoint: balance regfunc on funcadd failure in tracepointaddfunc When a tracepoint goes through the 0 - 1 transition, tracepointaddfunc invokes the subsystem's ext-regfunc before attempting to install the new probe via funcadd...

CVE-2026-46196

In the Linux kernel, the following vulnerability has been resolved: tracepoint: balance regfunc on funcadd failure in tracepointaddfunc When a tracepoint goes through the 0 - 1 transition, tracepointaddfunc invokes the subsystem's ext-regfunc before attempting to install the new probe via funcadd...

Ettercap security vulnerabilities

Ettercap is an open-source suite designed to protect against man-in-the-middle attacks. It features sniffing of real-time connections and dynamic content filtering. Versions of Ettercap prior to 0.8.3 contained security vulnerabilities. These vulnerabilities stemmed from improper parameter handli...

EUVD-2025-209885

ORSEE Online Recruitment System for Economic Experiments 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem. Certain field configurations accept values beginning with the prefix "func:" which are passed directly into an eval...

PT-2026-41373

Name of the Vulnerable Software and Affected Versions ORSEE Online Recruitment System for Economic Experiments version 3.1.0 Description An authenticated Remote Code Execution issue exists in the participant profile field processing subsystem. Certain field configurations allow values starting wi...

CVE-2025-67031

The ORSEE (Online Recruitment System for Economic Experiments) version 3.1.0 is vulnerable to an authenticated Remote Code Execution (RCE) flaw within its participant profile field processing subsystem. The root cause is that specific field configurations accept values starting with the "func:" p...