455545 matches found
Malicious code in pxnpm (npm)
pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...
Redis 5.0.7 Lua Sandbox Escape
Redis version 5.0.7 as packaged by Debian and Ubuntu leaves the Lua package global accessible, allowing EVAL scripts to load Lua's io module and execute host commands. The supplied environment and proof of concept demonstrate CVE-2022-0543. https://packetstorm.news/download/234982...
ROS-20261009-73-0106
The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20261009-73-0457
The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-108906
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, an...
PT-2026-108871
Name of the Vulnerable Software and Affected Versions Livees Checkout WordPress plugin versions prior to 7.0.3 Description The order confirmation page fails to perform capability, nonce, or order-key checks before processing request parameters. This allows unauthenticated users to modify the stat...
PT-2026-108723
Name of the Vulnerable Software and Affected Versions FalkorDB versions prior to 4.18.1 Description A double free and use-after-free issue exists in the RdbLoadDeletedNodes function of the RDB graph decoders. A remote attacker capable of issuing Redis replication commands can trigger a denial of...
ROS-20261009-73-0115
The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Microsoft SQL Server Buffer Overflow
The vulnerability of the Microsoft SQL Server database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Microsoft SQL Server Buffer Overflow
The vulnerability of the Microsoft SQL Server database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Windows Imaging Component Code Execution
The vulnerability of the Windows Imaging Component WIC framework in Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
Cisco NX-OS NGOAM Protocol Code Execution
The vulnerability of the NGOAM protocol implementation in the Cisco NX-OS operating system for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series devices lies in the fact that operation data is written outside of the buffer in memory. Exploiting this vulnerability allows a malicious act...
MiracleLinux 8 : postgresql:12 (AXSA:2026-2007:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2007:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL psql...
Cisco NX-OS NGOAM Protocol Code Execution
The vulnerability of the NGOAM protocol implementation in the Cisco NX-OS operating system for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series devices lies in the fact that operation data is written outside of the buffer in memory. Exploiting this vulnerability allows a malicious act...
ROS-20261009-73-0542
The vulnerability in the kernel-lt is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code...
ROS-20261009-73-0458
The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-109314
Name of the Vulnerable Software and Affected Versions @tinacms/cli versions prior to 3.0.0 Description @tinacms/cli fails to properly escape or encode Git branch values read from VERCEL GIT COMMIT REF, GITHUB BRANCH, or HEAD. These raw values are incorporated into the API URL and interpolated int...
VulnCheck KEV: CVE-2026-91136
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...