164408 matches found
MAL-2026-17533 Malicious code in @anfular/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...
Malicious code in api-nebula (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8232ec7756422686c2bce805fc87821e61a5bd9176cdb2fe7c3190fd2b2eae2 The package declares "preinstall": "node preinstall.cjs" in package.json, and preinstall.cjs is a single-line 187 KB Function"pbeIUC", "…" invocation...
kernel: tipc: fix double-free in tipc_buf_append()
A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...
kernel: netfilter: flowtable: publish GC-visible tuple last
A flaw was found in the netfilter flowtable component of the Linux kernel. This vulnerability occurs due to a timing issue where the system's garbage collection can free a network flow while it is still being set up. This can lead to a 'use-after-free' condition, where the system attempts to acce...
CVE-2026-12171: Inclusion of Functionality from Untrusted Control Sphere
auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...
CVE-2026-88392: Improper Limitation of a Pathname to a Restricted Directory
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
PT-2026-106242
Name of the Vulnerable Software and Affected Versions AMD Versal™ Adaptive SoC affected versions not specified Description Insufficient boundary checks in USB boot mode, when enabled via board modifications, allow the use of crafted images to trigger a buffer overflow. This can overwrite an activ...
CVE-2026-78861
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...
CVE-2026-78861
The Mercusys AC12 V2 is vulnerable to a flaw where a local attacker can execute arbitrary code . This vulnerability is caused by the inclusion of a hardcoded 512-bit RSA Private Key within the device. While the CVSS 3.1 score is 7.7 (High) , indicating high impact on confidentiality and integrity...
CVE-2026-0482: Out-of-bounds Write
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This...
CVE-2026-100103: Use of Default Credentials
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...
CVE-2026-37719
An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...
PT-2026-105997
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
EUVD-2026-92441
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
ROS-20261005-73-0089
The vulnerability in dotnet10.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-88392
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
CVE-2026-78861: Memory Allocation with Excessive Size Value
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...
CVE-2026-78860
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...
PT-2026-104774
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...
CVE-2026-105677: Improper Limitation of a Pathname to a Restricted Directory
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0...