CVE-2026-57527: Deserialization of Untrusted Data

Zed Attack Proxy ZAP ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter...

CVE-2026-30040: Heap-based Buffer Overflow

A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context of the current process via supplying a crafted JPEG 2000 JP2 file...

CVE-2026-30041: Uncontrolled Resource Consumption

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service DoS via supplying a crafted PSD file...

The vulnerability of the formSetAutoPing() function (/goform/setAutoPing) in the Tenda i3 wireless access point software allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the formSetAutoPing function /goform/setAutoPing of the Tenda i3 wireless access point software lies in the fact that the operation’s results may escape from memory when processing the parameters ping1 and ping2. Exploiting this vulnerability could allow a malicious actor to...

RockyLinux 8 : libpng (RLSA-2026:29898)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:29898 advisory. libpng: libpng: Arbitrary code execution due to use-after-free vulnerability CVE-2026-33416 Tenable has extracted the preceding description block directly from t...

RHEL 8 : libpng (RHSA-2026:29901)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:29901 advisory. The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics PNG image format files. Security Fixes:...

Devolutions UniGetUI < 2026.2.1 Arbitrary Code Execution (DEVO-2026-0019)

The version of Devolutions UniGetUI installed on the remote host is 2026.2.0 or earlier. It is, therefore, affected by an arbitrary code execution vulnerability: - Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet...

RHEL 8 : perl-IO-Compress (RHSA-2026:30115)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:30115 advisory. This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress...

CVE-2026-53148

A flaw was found in the Linux kernel's Thunderbolt driver. A malicious peer can exploit this vulnerability by sending a specially crafted response that causes the system to write data beyond an allocated memory buffer. This out-of-bounds write can lead to memory corruption, which may allow an...

CVE-2026-53256

A flaw was found in the Linux kernel's Bluetooth RFCOMM Radio Frequency Communication subsystem. A race condition in the rfcommconnectind function, specifically during the handling of listener sockets, can lead to a use-after-free vulnerability. A local attacker could exploit this to cause a deni...

CVE-2026-53196

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

CVE-2026-47208

A flaw was found in vm2, an open-source virtual machine VM sandbox for Node.js. This vulnerability allows an attacker to escape the sandbox environment by writing malicious code. Successful exploitation can lead to arbitrary code execution on the host system, compromising the integrity and...

Malicious code in kelly-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350ccf4a19896a23680e7478be01909de7f16057f175dc14de1d4e0bb92ad540 On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: it fetches a JSON config fr...

MAL-2026-6482 Malicious code in kelly-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350ccf4a19896a23680e7478be01909de7f16057f175dc14de1d4e0bb92ad540 On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: it fetches a JSON config fr...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the PATCH process for public shares. An attacker can access or modify files outside the intended shared directory by crafting malicious requests that exploit improper path validation. Details A Directory Traversa...

GO-2026-5590 uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli

uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution in gitlab.com/uniget-org/cli...

CVE-2020-37256

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access...

CVE-2021-47987 Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

CVE-2021-47987 Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

CVE-2021-47987

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository, pointing to an unreviewed personal fork with write access. No releases were published with these tags; a project exposing a vulnerability would require a git-...