WordPress Insert or Embed Articulate Content into WordPress plugin < 4.3000000025 - Author+ Upload to RCE vulnerability

Author+ Upload to RCE vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Insert or Embed Articulate Content into WordPress versions 4.3000000025...

gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. Thi...

Improper Input Validation

Apache CXF is vulnerable to Improper Input Validation. The vulnerability is due to failure to validate the chash parameter when it is omitted by a non-compliant or misconfigured Identity Provider, which allows an attacker to substitute or inject an authorization code and potentially gain...

CVE-2026-88889

A flaw was found in Renovate. This command injection vulnerability exists in the Maven Wrapper manager, allowing a remote attacker to execute arbitrary commands. By specifying a malicious distributionType parameter in maven-wrapper.properties, an attacker can inject shell commands. This leads to...

CVE-2026-88884

A flaw was found in Renovate, a dependency update automation tool. This vulnerability allows for the bypass of the minimumReleaseAge security control when processing digest updates. A remote attacker could exploit this by publishing a malicious dependency version, which Renovate would then...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

vim: Vim: Heap buffer overflow allows arbitrary code execution

A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the setsofo function fails to reset internal data between sections, leading to an out-of-bounds write...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

EUVD-2026-75439

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

CVE-2026-88889

Renovate (dependency update automation tool) versions before 44.14.7 contain a command injection vulnerability in the Maven Wrapper manager . An unescaped distributionType parameter in maven-wrapper.properties allows attackers to inject shell commands, leading to remote code execution when Renova...

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence AI to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and...

USN-8737-2: GNU C Library vulnerabilities

USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides the corresponding fixes for Ubuntu 24.04 LTS. Original advisory details: It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right-justification padding. An attacker could possibly...

FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway

A flaw was found in FreeRDP. FreeRDP clients using TS Gateway are vulnerable to a heap-buffer-overflow. A malicious gateway can send a specially crafted response fragment, causing the client to write beyond its allocated buffer. This can lead to a client crash, resulting in a Denial of Service Do...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Update Chrome now to protect against an actively exploited vulnerability

Chrome is rolling out an update for its desktop browser. The update includes 230 security fixes, one of which is known to be actively exploited. The stable channel has been updated to 153.0.8010.36/.37 for Windows and Mac, and 153.0.8010.36 for Linux. How to update Chrome If you don’t want to wai...

Malicious code in eka-kue10-breki (npm)

Source: amazon-inspector 47a330b3541b1f257622058b7ffaf9e94373c03c4680af91b835588b5837648d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-kue17-wekto (npm)

Source: amazon-inspector 440d59a3b79d4fd634144954577747aa1102ba9d852467374671122468df9b30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...