211421 matches found
EUVD-2026-58287
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...
CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...
EUVD-2026-58238
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...
EUVD-2026-58237
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow...
CVE-2026-73649
creationtimestamp| type| source ---|---|--- 2026-08-13 18:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msybmctsmt2e 2026-08-13 20:35:09+00:00| published-proof-of-concept| https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3...
CVE-2026-73649
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...
UBUNTU-CVE-2026-73566
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname and no segment cap when tar.t... or tar.x... receives a non-empty member-selection list. A...
Malicious code in @kolbo/mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is...
Malicious code in prediction-trader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87 index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch variables named iconDomain/getPlugin,...
Malicious code in velora-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...
Malicious code in copytrade-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c8773c5727069f87e54d58cd3679252a90ec0fe3de3a1b4adcb9a3bbff68bd index.js exports a getPlugin function that issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108, takes the...
Malicious code in @opezneppelin/contracts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab @opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script scripts/postinstall.js hex-escapes all module...
libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...
libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...
libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...
CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
CVE-2026-13048
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
EUVD-2026-58117
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
CVE-2026-66256
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...
CVE-2026-63423
During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...