chromium-browser: angle: ANGLE: Arbitrary code execution via use after free

A flaw was found in ANGLE, a component of Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside the browser's security sandbox. The attacker could exploit this by enticing a user to visit a specially crafted HTML page...

chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page

A flaw was found in ANGLE, a component of Google Chrome on Android. This 'use after free' vulnerability allows a remote attacker to execute arbitrary code outside the browser's security sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page. Successful exploitati...

MAL-2026-18439 Malicious code in @an1mshnpmb9c84920/pipeprobe-obf-m19n5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2 The package's prepare lifecycle script executes node index.js, which reconstructs the hostname npmp19n5--768.oob.awss.dev by joining a string array a...

Malicious code in @an1mshnpmb9c84920/pipeprobe-obf-m19n5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2 The package's prepare lifecycle script executes node index.js, which reconstructs the hostname npmp19n5--768.oob.awss.dev by joining a string array a...

Exploit for CVE-2026-98432

Check · Exploit · Detection · PCAP · Impact · Write-up ---...

CVE-2026-55261: Google Android: In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing…

In nfat4tnfceestorerxbuf of nfanfceeact.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-120451: gPhoto libgphoto2: libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that…

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005cinit that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more...

CVE-2026-120433: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the…

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

Apache Camel AWS2S3Utils Code Execution

The vulnerability in the AWS2S3Utils.determineKey function within the camel-aws2-s3 component of the Apache Camel Java framework is related to improper handling of special elements used in the expression language operator. Exploitation of this vulnerability may allow a remote attacker to execute...

NGINX Map Directive Code Execution

The vulnerability in the Map Directive component of NGINX Plus and NGINX Open Source web servers is related to use-after-free memory allocation. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service or execute arbitrary code...

WebUSB Component Code Execution

The vulnerability in the WebUSB component of Google Chrome and Microsoft Edge is related to use-after-free memory usage. Exploitation of this vulnerability may allow an attacker to execute arbitrary code via a malicious peripheral device...

PT-2026-135356

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability...

CVE-2026-120315: lobehub chat: LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to…

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile. Attackers can create a file record via file.createFile with a traversal name, then trigger document parsin...

PT-2026-135502

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

CVE-2026-120438: QuickJS-NG: QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a…

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potentia...

CVE-2026-116958: A flaw was found in konflux-ci

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-77880: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API…

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

PT-2026-135447

Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the...

PT-2026-135491

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.16 Description An OS command injection flaw exists in the protected directory user panel module. The issue occurs when unescaped input is submitted through the file POST parameter in the acc=deletedp actio...

PT-2026-135419

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution...