CVE-2026-84659

A flaw was found in the Jenkins Script Security Plugin. This vulnerability allows an attacker to bypass security restrictions by disabling the global script sandbox. By exploiting a missing permission check through Stapler data binding, an attacker can execute arbitrary code, potentially...

CVE-2025-55182

CVE-2025-55182 This repository contains a PoC reproduction of CVE-2025-55182 , a critical security vulnerability in React Server Components RSC that allows unauthenticated arbitrary code execution. Description The vulnerability exists in how React Server Components deserialize "Server Actions" fr...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

CVE-2026-79831

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79830

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

CVE-2026-79831

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution . The vulnerability affects the Posix User Threads component, specifically version T1280 - T1280L02^ACG and earlier . HPE has released a fix in version T1280L02^ACH (L24.08 onwards), which does not require...

EUVD-2026-102002

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

CVE-2026-79831 HPE NonStop Posix User Threads - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution...

PYSEC-2026-4267 PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow

Summary An unsafe dynamic module loading vulnerability allows an attacker who can control a workflow file and a sibling tools.py to execute arbitrary Python code when the workflow is executed. Details The vulnerability is located in the workflow structured output resolution logic. File:...

PYSEC-2026-4271 PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification

Summary The plugin manager loads and executes arbitrary .py files from .praisonai/plugins/ directories both project-level and user home via importlib.util.specfromfilelocation + execmodule with zero code signing, integrity verification, or sandboxing. Any attacker who can write a file to the...

PYSEC-2026-4266 PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...

CVE-2026-79830

A stack buffer overflow vulnerability exists in the HPE NonStop Kernel Level Thread Model Lib (component T1132 ), which could allow an attacker to achieve arbitrary code execution . The vulnerability poses a risk of memory corruption , denial of service (DoS) , and stack overflow . HPE has releas...

EUVD-2026-102001

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

CVE-2026-79830 HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

[SECURITY] [DLA 4836-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4836-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 15, 2026 https://wiki.debian.org/LTS -...

EUVD-2026-101930

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

CVE-2026-101311

The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, and the framebuffer BAR I/O and RFB rendering...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename

A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to...