CVE-2026-10796

Vulnerability summary (CVE-2026-10796) : nvm (Node Version Manager)

CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

CVE-2026-10796

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

EUVD-2026-34303

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

CVE-2026-10796 nvm executes commands from a malicious Node.js mirror's version strings

nvm Node Version Manager through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as nvm install read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs...

Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

Cisco has patched a bug in Unified Communications Manager that lets an unauthenticated attacker on the network write files to the box and, from there, climb to root. It is tracked as CVE-2026-20230, and proof-of-concept exploit code is already public. Cisco's PSIRT says it has not seen the flaw...

EUVD-2026-34302

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution...

CVE-2026-50266

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...

CVE-2026-50266

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set deviceowner to a value that has "network:" at the beginning "network:dhcp" for example. The default port RBAC policies incorrectly included PROJECTMANAGER without...

ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories

It got stupid again. The internet still feels held together with tape. Bad plugins, old bugs, fake tools, trusted apps doing shady things. Same mess, new wrapper. And now the weird stuff is normal. Forums go down and come back worse. Cheap hackers get better toys. AI starts breaking real systems...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, timoni, helm, crossplane-provider-aws-cloudwatchlogs, metrics-server, runc, opentofu, trino, volume-modifier-for-k8s, flyte, newrelic-nri-kube-events, crossplane-provider-aws-lambda,...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, timoni, helm, crossplane-provider-aws-cloudwatchlogs, metrics-server, runc, opentofu, trino, volume-modifier-for-k8s, flyte, newrelic-nri-kube-events, crossplane-provider-aws-lambda,...

GHSA-H3GM-Q7M7-MP28 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, nri-couchbase, helm, pgpool2exporter, timoni, crossplane-provider-aws-cloudwatchlogs, harbor-scanner-trivy, harbor, litestream, glab, metrics-server, octo-sts, src, runc, croc, manifest-tool,...

CVE-2026-27145 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, nri-couchbase, helm, pgpool2exporter, timoni, crossplane-provider-aws-cloudwatchlogs, harbor-scanner-trivy, harbor, litestream, glab, metrics-server, octo-sts, src, runc, croc, manifest-tool,...

CVE-2026-42507 vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, nri-couchbase, helm, pgpool2exporter, timoni, crossplane-provider-aws-cloudwatchlogs, harbor-scanner-trivy, harbor, litestream, glab, metrics-server, octo-sts, src, runc, croc, manifest-tool,...

GHSA-4279-Q6MJ-392R vulnerabilities

Vulnerabilities for packages: kubernetes, crossplane-provider-aws-firehose, crossplane-provider-aws-s3, nri-couchbase, helm, pgpool2exporter, timoni, crossplane-provider-aws-cloudwatchlogs, harbor-scanner-trivy, harbor, litestream, glab, metrics-server, octo-sts, src, runc, croc, manifest-tool,...

CVE-2019-25727

The CVE-2019-25727 entry describes an Arbitrary File Download vulnerability in WordPress Plugin ad manager wd 1.0.11. An unauthenticated attacker can target the edit.php endpoint by supplying export=export_csv and a malicious path parameter to read sensitive files accessible to the web server (e....

CVE-2019-25727 WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=exportcsv and a malicious path paramet...

CVE-2026-42504 vulnerabilities

Vulnerabilities for packages: contour, openbao-k8s-fips, crossplane-provider-aws-kendra-fips, authservice-fips, helm-diff-fips, kubernetes-csi-external-provisioner-fips, kubescape, external-dns-fips, crossplane-provider-aws-ecs, grafana-alloy, tigera-operator, dcgm-exporter, gitlab-kas-fips,...

GHSA-H524-452V-82P9 vulnerabilities

Vulnerabilities for packages: contour, openbao-k8s-fips, crossplane-provider-aws-kendra-fips, authservice-fips, helm-diff-fips, kubernetes-csi-external-provisioner-fips, kubescape, external-dns-fips, crossplane-provider-aws-ecs, grafana-alloy, tigera-operator, dcgm-exporter, gitlab-kas-fips,...