MSC-2026-11638

Trojanized mathjs clone. lusolve calls removeSolveValidation, which calls is.isGraph: it AES-256-GCM-decrypts a filename and a module from bundled ciphertext utils/graph.js, utils/fraction.js, utils/bignumber/type.js, writes the plaintext to disk and requires it, executing attacker-supplied code ...

Arbitrary Code Injection

Grav CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to insufficient validation of uploaded ZIP archives in the Flex Objects plugin, which allows an authenticated attacker to bypass filename validation, upload malicious PHP files to the web root, and execute arbitrary code...

Arbitrary Code Injection

Grav is vulnerable to Arbitrary Code Injection. The vulnerability is due to incomplete validation of dynamic-data bare functions using a denylist instead of an allowlist, which allows an attacker with page-edit or blueprint-config access to invoke errorlog, write malicious PHP payloads to...

Malicious code in xzvbailsx (npm)

Source: amazon-inspector ac9176da252791a96b93c24e702c2245fb96d9655cdf9f31d61e9bc3e0c21528 package.json declares the dependency libsignal with source github:tenka-san/libsignal-node, an unpinned GitHub ref with no commit SHA, tag, or integrity hash. On npm install, npm fetches whatever HEAD of tha...

CVE-2026-93467

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

CVE-2026-93467 HGiga｜OAKlouds - Insecure Deserialization

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

CVE-2026-93467 HGiga｜OAKlouds - Insecure Deserialization

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

SUSE CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

PT-2026-95471

Name of the Vulnerable Software and Affected Versions IBM MQ for HPE NonStop affected versions not specified Description An authenticated attacker can cause a denial of service or potentially execute arbitrary code. This issue occurs due to improper validation of message distribution list...

PT-2026-95411

Name of the Vulnerable Software and Affected Versions Sublime Text 4 versions prior to Build 4193 Sublime Text 3 versions prior to Build 3208 Description A local privilege escalation issue exists in the update staging mechanism. An unprivileged local attacker can place a malicious DLL in the...

PT-2026-95615

Name of the Vulnerable Software and Affected Versions IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 Description The IBM MQ C client fails to properly validate responses from the queue manager when requesting AMS Application Managed Service policy data. This flaw could allow a remote...

PT-2026-95464

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance affected versions not specified Description A heap buffer overflow occurs during protocol message processing before authentication. This flaw allows a remote attacker to cause a denial of service or potentially execute arbitra...

PT-2026-95470

Name of the Vulnerable Software and Affected Versions IBM MQ affected versions not specified Description An authenticated attacker can cause a denial of service or potentially execute arbitrary code. This issue is caused by an integer overflow, which occurs when an arithmetic operation results in...

CVE-2026-82832: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-11727: Heap-based Buffer Overflow

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...

CVE-2026-7006: Download of Code Without Integrity Check

Sublime Text for Windows through Build 4192 Sublime Text 4 and Build 3207 Sublime Text 3 contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a...

CVE-2026-11381: Heap-based Buffer Overflow

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures...

CVE-2026-10858: Heap-based Buffer Overflow

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

PT-2026-102923

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.13 Description The generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In bash and zsh scripts, a crafted virtual...

EulerOS Virtualization 2.11.1 : freetype (EulerOS-SA-2026-3414)

According to the versions of the freetype package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when attempting ...