CVE-2026-18718 — Updated!

Advisory: GHSA-pcfh-853f-q3gh · Severity: High CVSS 7.5 · Affected: Ghidra ≤ 12.1.2 · Fixed: c03a70d Ghidra 12.1.3 Opening someone else's Ghidra project was enough to execute their code. Ghidra 12.1.2 stores analyzer options inside the program database , and one of those options is a filesystem...

Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

CVE-2026-75137

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75135

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-75137 UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75137 UpSignOn < 7.19.0 Sensitive Data Exposure in Process Memory after Lock

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

CVE-2026-75137

UpSignOn for Windows versions before 7.19.0 are affected by a sensitive data exposure vulnerability in process memory after the application has been locked. A local attacker with the PROCESS_VM_READ permission can read the memory space of UpSignOn.exe and extract cleartext vault data, including e...

EUVD-2026-70262

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESSVMREAD permission to read the memory space of UpSignOn.exe a...

EUVD-2026-70260

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-84648

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

EUVD-2026-70114

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata source, level, and timestamp resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers in control of agent processes...

CVE-2026-84648

Jenkins versions 2.579 and earlier , and LTS 2.568.2 and earlier , are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that the system log viewer fails to escape log record metadata, specifically the source, level, and timestamp . This flaw is exploitable by att...

Cross-site Scripting (XSS)

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the download process. An attacker can execute arbitrary JavaScript in the context of the application...

CVE-2026-78408

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve. Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an...

CVE-2026-78408

util-linux nsenter --join-cgroup opens the target cgroup.procs file as root and leaves the file descriptor open across subsequent namespace, credential, and execve() transitions. Because the kernel evaluates later cgroup migrations against the credentials of the original open, a process in an att...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the media handler process. An attacker can access files outside the intended directory and potentially obtain sensitive information by crafting requests that exploit incomplete containment checks for sibling...

SUSE CVE-2026-84323

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-84328

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-84329

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. Chromium security severity: Low...