CVE-2026-66902 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call

Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as system$command, a single argument call that passes the whole...

CVE-2026-66902 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call

Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as system$command, a single argument call that passes the whole...

EUVD-2026-52921

Google::Auth versions before 0.06 for Perl run a command named in an externalaccount credentials JSON via an ungated system call. The Pluggable subclass reads credentialsource.executable.command from the credentials JSON and runs it as system$command, a single argument call that passes the whole...

YayTune_PoC

YayTunePoC This is a repository dedicated to technical test...

ALPINE-CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-18787 GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

CVE-2026-56848

A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-24084

Technical details about CVE-2026-24084 are not publicly available in the provided documents. Monitor for updates from the listed sources; current entries only state a weak configuration related to UE security capability replay verification.

CVE-2026-24078

Technical details about CVE-2026-24078 are not publicly available in the provided documents. Monitor for updates from official bulletins.

CVE-2026-67195 Perspective 5.0.0 RCE via eval() Expression Injection

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

RLSA-2026:49668 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

EUVD-2026-52661

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

CVE-2026-62927

In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch to address-space handlers after calculating authorization, allowing an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method...

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...

Amazon Linux 2 : freerdp, --advisory ALAS2-2026-3840 (ALAS-2026-3840)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3840 advisory. Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bindack maxxmitfrag On TS Gateway...