166860 matches found
MAL-2026-17243 Malicious code in express-nodejs (npm)
The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
MAL-2026-17247 Malicious code in exptredd (npm)
The package exptredd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
CVE-2026-84154 Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...
CVE-2026-84154 Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...
Multiple vulnerabilities in Pgpool-II
Overview Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below: Out-of-bounds Write CWE-787 - CVE-2026-92867 Improper Certificate Validation CWE-295 - CVE-2026-92868 Out-of-bounds Write CWE-787 - CVE-2026-92869 Stack-based Buffer Overflow CWE-121 -...
CVE-2026-91096
A flaw was found in proxygen. The WebTransport implementation fails to unregister read callbacks for closed streams before destroying them. This issue results in a use-after-free condition, where the transport attempts to invoke memory that has already been released. A remote attacker can exploit...
EUVD-2026-88648
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...
CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...
CVE-2026-97582
A flaw was found in the Linux kernel's GPIO fan driver. When a device is unbound, pending alarm work is not properly canceled before associated memory resources are freed, resulting in a use-after-free condition. A local attacker could exploit this race condition to cause a Denial of Service DoS...
Lantronix G520 Series Cellular Gateway
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...
USN-8841-1: Perl DBI module vulnerabilities
It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-73193, CVE-2026-73194...
USN-8841-1 libdbi-perl vulnerabilities
It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-73193, CVE-2026-73194...
Malicious code in test-agency-assignment (npm)
Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm install on Windows hosts. 4444.vbs contains a hand-rolled...
CVE-2026-103041: Deserialization of Untrusted Data
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...
EUVD-2024-55777
Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...
CVE-2024-31027: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...
PT-2026-102936
Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description Multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. This allows attackers to send crafted serialized objects to exposed cache...
PT-2026-102457
Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description An authenticated user with permissions to edit an Environment or Project can provide specifically crafted JSON content for the object. This leads to insecure deserialization, which...
PT-2026-102456
Name of the Vulnerable Software and Affected Versions GEOVIA Geospatial Data Manager versions R2024x through R2026x Description A code injection flaw allows an attacker to execute arbitrary code on the server. Code injection is a type of attack where an attacker introduces malicious code into a...
PT-2026-102493
Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.07 Description When configured with the CONFIG IP DEFRAG=y parameter, the software fails to clear the IP reassembly state after delivering a complete datagram. This allows an attacker capable of delivering...