CVE-2026-2417 Missing Authentication for Critical Function in Pharos Controls Mosaic Show Controller

A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges...

JLSEC-2026-11 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG...

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the pngsetquantize API function. When the function is called with no histogram and the number of...

CVE-2026-29840

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering tags but fails to recursively remove dangerous event handlers in other HTML tags such as onerro...

Exploit for CVE-2026-26833

CVE-2026-26833: OS command injection in thumbler Summary...

Exploit for CVE-2026-26832

CVE-2026-26832: OS command injection in node-tesseract-ocr...

Malicious code in no-function-declare-after-return (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40f5de9e9b3e66259de31f34cf47ef3b38b8fefc1e80d860c6dab7cade495bca The package no-function-declare-after-return was found to contain malicious code...

MAL-2026-2377 Malicious code in no-function-declare-after-return (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40f5de9e9b3e66259de31f34cf47ef3b38b8fefc1e80d860c6dab7cade495bca The package no-function-declare-after-return was found to contain malicious code...

Arbitrary Code Injection

SandboxJS is vulnerable to Arbitrary Code Injection. The vulnerability is due to improper isolation allowing access to Function via arrays and object construction, which allows an attacker to escape the sandbox and execute arbitrary code...

Remote Code Execution (RCE)

next-mdx-remote is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient sanitization of MDX content in the serialize function, which allows an attacker to execute arbitrary code...

CVE-2026-33320

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. Starting in version 3.0.0 and prior to version 3.3.1, Dasel's YAML reader allows an attacker who can supply YAML for processing to trigger extreme CPU and memory consumption. The issue is in the...

CVE-2026-4617

A weakness has been identified in SourceCodester Patients Waiting Area Queue Management System 1.0. The impacted element is the function ValidateToken of the file /php/apipatientcheckin.php of the component Patient Check-In Module. Executing a manipulation can lead to improper authorization. It i...

EUVD-2026-14652

The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval in the processcustomformula function within includes/process/price.php. This is due to insufficient sanitization an...

SUSE CVE-2026-4437

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the...

PT-2026-47381

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs when unloading the module on gen 4. This issue is caused by the cleanup code incorrectly calling the vsp1 drm cleanup function instead of the vsp1 vspx...

PT-2026-27478

Name of the Vulnerable Software and Affected Versions Pharos Controls Mosaic Show Controller version 2.15.3 Description A missing authentication check for a critical function allows an unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges. This...

CVE-2026-29840

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering tags but fails to recursively remove dangerous event handlers in other HTML tags such as onerro...

CVE-2026-29840

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering...

PT-2026-27448

JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering tags but fails to recursively remove dangerous event handlers in other HTML tags such as onerro...

Linux TCP Input Buffer Overflow DoS

The vulnerability of the tcpmtupprobesuccess function in the net/ipv4/tcpinput.c module of the Linux kernel is related to zero-division errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

IBM Sterling B2B Integrator File Gateway Authentication Bypass

The vulnerability of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file gateway software lies in the lack of authentication for a critical function. Exploiting this vulnerability can allow an attacker to gain read and delete access to data...