CVE-2026-84811 agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode

agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious pycache entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports...

CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84809

Tencent AI-Infra-Guard 's skill-scan component (affected in v4.6.0) hardcodes __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. An attacker can distribute a skill containing benign Python source files alongside malicious compiled bytecode tha...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...

CVE-2026-23885

Security Advisory: CVE-2026-23885 Authenticated Remote Code Execution RCE in AlchemyCMS 1. Executive Summary A critical security vulnerability involving Improper Neutralization of Directives in Dynamically Evaluated Code CWE-95 was discovered in the AlchemyCMS framework. The vulnerability allows...

CVE-2026-52831

CVE-2026-52831 affects Nuclio , a serverless framework for real-time events and data processing. In versions prior to 1.16.4 , the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, ). Two fields in the...

CVE-2026-4802

CVE-2026-4802 - تنفيذ التعليمات البرمجية عن بُعد عبر حقن الأوامر في Cockpit إثبات مفهوم لاستغلال CVE-2026-4802، وهو تنفيذ تعليمات برمجية عن بُعد عبر حقن الأوامر في واجهة سجلات النظام في Cockpit loadServiceFilters الإعداد قم ببناء وتشغيل البيئة القابلة للاستغلال: root@kitploit: $ docker build -t...

EUVD-2026-70216

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories values with the . action, which...

CVE-2026-82404 TOON: Prototype pollution when decoding untrusted TOON input

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In...

CVE-2026-82404 TOON: Prototype pollution when decoding untrusted TOON input

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X تحليل إعادة البناء CVE-2026-21858: Ni8mare - سلسلة استغلال كاملة لـ RCE في n8n 1. الملخص التنفيذي والنظرة العامة تقدم هذه الوثيقة تحليلًا تقنيًا حتميًا لإعادة بناء ثغرة CVE-2026-21858، المُسمّاة داخليًا Ni8mare. تحمل هذه الثغرة درج...

wasm2c-tableflip

wasm2c sandbox escape: وحدة ضيف تشغّل أمر قشرة على المضيف اقرأ المدونة: trustsig.eu/blog wasmrtallocatefuncreftable في wasm2c/wasm-rt-impl-tableops.inc يضبط table-size من عدد العناصر المُعلن في الوحدة ثم يتجاهل نتيجة calloc. عندما يفشل التخصيص، تبقى الجدول مع data == NULL وsize الكامل المُعلن، لذ...

CVE-2026-2441

CSS في Google Chrome قبل تنفيذ التعليمات البرمجية عن بُعد CVE-2026-2441 نظرة عامة تم تحديد ثغرة أمنية بدرجة خطورة HIGH، مصنفة باسم CVE-2026-2441، ضمن فئة CWE-416، CWE-416، CVSS 8.8. سمحت ثغرة الاستخدام بعد التحرير Use after free في CSS في Google Chrome قبل الإصدار 145.0.7632.75 لمهاجم عن بُعد...

CVE-2026-84670

Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84645

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

CVE-2026-20212

CVE-2026-20212 affects the Silicon One Hardware Abstraction Layer (S1HAL) in Cisco Nexus 9000 Series Switches . The root cause is that TCP ports 43210 and 43211 are accessible in the default Layer 3 VRF, allowing an unauthenticated, remote attacker to send crafted input that executes code with ro...

EUVD-2026-70201

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...

CVE-2026-20212 Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 L3 virtual routing and...