Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46307)

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: The ath5k driver seems to do an array-index-out-of-bounds access as shown by the UBSAN kernel message: UBSAN: array-index-out-of-bounds in...

GO-2026-6688 Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize

Mutually-referencing array formulas recurse unboundedly, causing a fatal stack overflow in github.com/xuri/excelize...

CVE-2026-112770

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

EUVD-2026-104576

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-112770 Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-112770 Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-112770 Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other arrow-accepting filters. Authenticated control panel users can pass an...

CVE-2026-112770

Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0 are vulnerable to remote code execution (RCE) via the Twig group filter . The root cause is that the filter invokes non-string arrow arguments as callables without the mandatory checkArrow guard. An authenticated control panel user can ex...

github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in request decoding

A flaw was found in kin-openapi. An unauthenticated remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing specific array query parameters or form-encoded data. Because the request decoder fails to properly validate certain array schemas before...

qs: qs: Denial of Service via unhandled exception during array serialization

A flaw was found in qs. A remote attacker could cause a Denial of Service DoS by supplying specially crafted input to an application that re-serializes data using the comma array format. Because the library fails to safely handle array elements that cannot be converted to a string, an unhandled...

OPENSUSE-SU-2026:22136-1 Security update for python-joserfc

This update for python-joserfc fixes the following issues: Changes in python-joserfc: - CVE-2026-102946: JWS signature verification can be bypassed via empty signatures array bsc1285840...

Malware in array-inline

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17942 Malicious code in array-inline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8909a6ff094fd04116daf7c014101e9b002e9ea6e6456ff7ab5faecdf1422e1 Package [email protected] was scanned across 5 files with no a static rule matches and no traced behaviors indicating credential access, network...

Malicious code in array-inline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8909a6ff094fd04116daf7c014101e9b002e9ea6e6456ff7ab5faecdf1422e1 Package [email protected] was scanned across 5 files with no a static rule matches and no traced behaviors indicating credential access, network...

MAL-2026-17934 Malicious code in array-inline-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56155285d4d49f75322eac616667d54fabe1c19efbf500a0cd631c479380d5bb The package contains a small number of files and no static or traced findings indicate credential access, install-time code fetch/execute, silent rel...

Malicious code in array-inline-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56155285d4d49f75322eac616667d54fabe1c19efbf500a0cd631c479380d5bb The package contains a small number of files and no static or traced findings indicate credential access, install-time code fetch/execute, silent rel...

Malware in array-inline-transform

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview array-inline is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview array-inline-transform is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page

A flaw was found in ANGLE, a graphics engine used in Google Chrome. This vulnerability, caused by improper validation of an array index, allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation can occur when a user visits a specially crafted HTML...