PT-2026-55466

Name of the Vulnerable Software and Affected Versions SpecifyJS versions prior to 0.2.136 Description CSS value sanitization in the core/src/server/render-to-string.ts file used simple regular expressions to strip expression and urljavascript:, which could be bypassed using null bytes, CSS...

The vulnerability of the command-line interface of GitHub Copilot allows a hacker to execute arbitrary code.

The vulnerability of the GitHub Copilot command-line interface is related to incorrect behavior. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

openSUSE 16: libnilfs0 / libnilfscleaner0 / libnilfsgc0 / nilfs-utils / etc (openSUSE-SU-2026:21183-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21183-1 advisory. Changes in nilfs-utils: - CVE-2026-55392: Fixed undefined behavior in nilfssbisvalid bsc1268553 Tenable has extracted the preceding description block...

Malicious code in ts-eslint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5bbed232e0268a791ce846260ce170342eec359bf1a7e84b9514767d77803a1 The package's index.js defines run/fromstr that recursively walk process.cwd and match files named.env, env, id.json, config.json, config.toml,...

CVE-2026-10538

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker ...

CVE-2026-10538

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker ...

PT-2026-54505

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker ...

CVE-2026-10538: Deserialization of Untrusted Data

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker ...

Incorrect Behavior Order

Overview @fastify/express is an Express compatibility layer for Fastify Affected versions of this package are vulnerable to Incorrect Behavior Order due to incorrect mount path prefix rewriting in the use middleware handling. An attacker can reach protected routes without the intended middleware ...

CVE-2026-8452

CVE-2026-8452 is a heap overflow in NetScaler ADC/Gateway memory handling (CWE-119), exploitable unauthenticated to crash or take control of appliances configured as Gateways or AAA servers. A public PoC achieves pre-auth RCE on version 13.1-30.52. Affected: 14.1 before 14.1-72.61 and 13.1 before...

OPENSUSE-SU-2026:21183-1 Security update for nilfs-utils

This update for nilfs-utils fixes the following issues: Changes in nilfs-utils: - CVE-2026-55392: Fixed undefined behavior in nilfssbisvalid bsc1268553...

Malicious code in vue-demi-fix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bf683b6e8715fecd451a06da256d90048054cbe463da64e43c1a8db4226b661 vue-demi-fix is a name-confusion package against the widely used vue-demi library. package.json declares both preinstall and postinstall lifecycle...

Delta Electronics DVP12SE PLC

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to remotely issue commands, modify operational values, interfere with control logic, and alter device behavior without authentication or privilege enforcement. 2. RECOMMENDED PRACTICES CISA recommends users...

PYSEC-2026-575 wolfSSL Python module vulnerable to Improper Authentication

A vulnerability in the handling of verifymode = CERTREQUIRED in the wolfssl Python package wolfssl-py causes client certificate requirements to not be fully enforced. Because the WOLFSSLVERIFYFAILIFNOPEERCERT flag was not included, the behavior effectively matched CERTOPTIONAL: a peer certificate...

PYSEC-2026-567 vLLM Allows Remote Code Execution via PyNcclPipe Communication Service

Impacted Environments This issue ONLY impacts environments using the PyNcclPipe KV cache transfer integration with the V0 engine. No other configurations are affected. Summary vLLM supports the use of the PyNcclPipe class to establish a peer-to-peer communication domain for data transmission...

Malicious code in clob-client-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b36bbf14a743630a93ba7f8d7529d3fae8073f0f585af4343506be6248fc1b59 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

MAL-2026-6587 Malicious code in clob-client-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b36bbf14a743630a93ba7f8d7529d3fae8073f0f585af4343506be6248fc1b59 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

PT-2026-53640

Impact It was possible to overwrite Git configuration remotely and override some of its behavior. Resources Thanks to Jason Marcello for responsible disclosure...

CVE-2025-59868

HCL Traveler for Microsoft Outlook HTMO is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application...

EUVD-2025-210365

HCL Traveler for Microsoft Outlook HTMO is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown behavior in the application...