NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...

NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium

authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

CVE-2026-106580

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-76457 Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

EUVD-2026-94459

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-76457 Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-76457

The Cisco NX-OS Software is subject to multiple out-of-bounds read vulnerabilities, identified under CWE-125 , following an internal security review. These issues are addressed in the October 2026 Software Security Hardening Release . The vulnerabilities have a HIGH base severity (CVSS 3.1: 8.6) ...

EUVD-2026-94408

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-106580

Versions of ImageMagick prior to 7.1.2-31 and 6.9.13-56 are vulnerable to a policy bypass in the CUT encoder . The root cause is a missing security-policy check, which allows a crafted local encoding operation to read data that should be denied by policy and can also result in a software crash . ...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

Security update for libXtst

This update for libXtst fixes the following issue: CVE-2026-94286: out-of-bounds read in libXtst's RECORD reply parser bsc1281665. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

SUSE-SU-2026:4566-1 Security update for libXtst

This update for libXtst fixes the following issue: - CVE-2026-94286: out-of-bounds read in libXtst's RECORD reply parser bsc1281665...

CVE-2026-77214

A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist ...

Security update for libXtst

This update for libXtst fixes the following issue: CVE-2026-94286: out-of-bounds read in libXtst's RECORD reply parser bsc1281665. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

SUSE-SU-2026:4565-1 Security update for libXtst

This update for libXtst fixes the following issue: - CVE-2026-94286: out-of-bounds read in libXtst's RECORD reply parser bsc1281665...

AZL-107228 CVE-2026-77214 affecting package cmake 3.30.3-15

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

DEBIAN-CVE-2026-77214

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

AZL-106728 CVE-2026-77214 affecting package expat 2.8.3-2

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...

CVE-2026-77214

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser-mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move...