Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-100925)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100925 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101345)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101345 advisory. Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 15...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-101278)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101278 advisory. A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-100897)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100897 advisory. The issue was addressed with improved checks. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing...

PT-2026-76713

A vulnerability exists in the interaction between a Endpoint Privilege Management Windows Deployment support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended...

PT-2026-76844

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A use-after-free issue, which occurs when a program continues to use a pointer after it has been freed, can lead to unexpected proces...

CVE-2026-64787: Use After Free

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected...

CVE-2026-64787: Use After Free

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-101167)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101167 advisory. This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1,...

CVE-2026-64715: Use After Free

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to an unexpected...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-101335)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101335 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26...

CVE-2026-74794

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74792 Scriban before 7.0.0 Stack Overflow via nested array initializers

Scriban before 7.0.0 affected versions = 6.6.0 contains a stack overflow vulnerability in nested array initializer parsing. Deeply nested array initializers recurse through a path ParseArrayInitializer → ParseExpression → ParseArrayInitializer that is not covered by the ExpressionDepthLimit count...

EUVD-2026-59953

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.tojson builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that...

CVE-2026-74787

Scriban before 7.0.0 contains an uncontrolled recursion vulnerability in the object.tojson builtin function that lacks depth limits and circular reference detection. Attackers can craft templates with self-referencing objects to trigger unbounded recursion, causing a StackOverflowException that...

EUVD-2026-59950

Scriban before 7.2.0 contains a denial of service vulnerability in the array.insertat function that allocates unbounded null entries without respecting LoopLimit or LimitToString constraints. Attackers can supply a large index parameter to trigger OutOfMemoryException and crash the host process i...

CVE-2026-74783: Uncontrolled Recursion

Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger ...

PT-2026-73069

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description A remote SQL injection is possible due to improper handling of the total count argument within the '/checkout process.php' endpoint. SQL injection is a technique where an attacker...

PT-2026-73168

Name of the Vulnerable Software and Affected Versions Net::OAuth versions prior to 0.32 Description An issue exists where memory exhaustion can occur due to unbounded caching of failed module loads within the smart require function. The function stores results in a process-global hash without...

Malicious code in twilio-hackerone-poc-afe6937c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...