Malicious code in pyprig (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315 Clone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a n...

MAL-2026-18490 Malicious code in pyprig (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315 Clone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a n...

Chamilo-LMS-CVE-2023-4220-Exploit

Chamilo LMS CVE-2023-4220 Exploit Overview This script exploits a Remote Code Execution RCE vulnerability in Chamilo LMS versions ≤ v1.11.24. The vulnerability CVE-2023-4220 exists due to unrestricted file upload functionality in the bigUpload.php feature of Chamilo LMS, which allows attackers to...

CVE-2026-96639

A flaw was found in Pillow. When processing multi-frame images that transition between different color modes, Pillow reuses an undersized native memory buffer without verifying that its format matches the subsequent frame. A remote attacker can exploit this flaw by providing a specially crafted...

Exploit for Authentication Bypass by Capture-replay in Microsoft

CVE-2026-62911 — Exchange MRSProxy Pre-Auth RCE Pre-authentic...

Malicious code in @ifasn/mdd-doc-mcp (npm)

Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata token X-aliyun-ecs-metadata-token, then reads a base64-conceal...

CVE-2026-86596

The s2Member plugin for WordPress (versions <= 260927 ) is vulnerable to Remote Code Execution (RCE) via the 'item_name' IPN parameter. The flaw stems from insufficient sanitization in the strip_php_tags_deep() function, which only removes literal <? sequences. This, combined with a post-in...

CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, = 260927 via the 'itemname' parameter parameter. This is due to insufficient sanitization in stripphptagsdeep, which only strips literal '?' sequences, combined with a post-interpolation...

CVE-2026-58927

The vulnerability is a Use-After-Free UAF in the EVS AIDL HAL, arising from a data race on an unsynchronized std::weakptr within EvsEnumerator::openCamera. Specifically, concurrent calls from a privileged UID e.g., AIDAUTOMOTIVEEVS can cause a torn weakptr state, leading to a virtual call through...

CVE-2026-58925

The report details a heap Use-After-Free UAF vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unorderedmap. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to...

DEBIAN-CVE-2026-29508

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-29508

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-116958 Konflux-ci: unquoted variable expansion in shell command execution

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-116958

A flaw in konflux-ci allows for arbitrary code execution because of improper quoting of shell variables within deployment scripts. A local attacker capable of providing arguments to the affected scripts can trigger unintended command substitution, resulting in the execution of commands with the p...

CVE-2026-116958 Konflux-ci: unquoted variable expansion in shell command execution

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

EUVD-2026-115629

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

MAL-2026-18487 Malicious code in @ifasn/mdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata toke...

Malicious code in @ifasn/mdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata toke...

CVE-2026-29508

A flaw was found in minidlna. This vulnerability allows a remote attacker to achieve arbitrary code execution or cause a Denial of Service DoS by placing a specially crafted DFF audio file into a directory monitored by the service. When processing the file, the application fails to validate an...