CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

Linux Distros Unpatched Vulnerability : CVE-2026-68453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/zcrypt: Fix buffer over-read in ccacipher2protkey Add validation of both the actual key buffer size and token length fields in all the ccachecksectoken...

Security Updates for Microsoft PowerPoint Products C2R (August 2026)

The Microsoft PowerPoint Products are missing a security update. It is, therefore, affected by the following vulnerability: - Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. CVE-2026-68809 Note that Nessus has not tested for this...

CVE-2026-68971

Apache Airflow is vulnerable to a cross-team authorization bypass in the asset materialization endpoint (POST /api/v2/assets/{asset_id}/materialize) and the XCom result check on wait_dag_run_until_finished. The root cause is that these specific sites authorize the target Dag without considering i...

CVE-2026-48056: Improper Input Validation

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s...

CVE-2026-73218: Improper Privilege Management

Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...

CVE-2026-73217: Protection Mechanism Failure

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

CVE-2026-18370

entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...

CVE-2026-18370

The CVE-2026-18370 entry details a heap-based buffer overflow in the entr utility, triggered in run_utility(). The code allocates a heap buffer via malloc(ARG_MAX) and copies command-line arguments into it, advancing the destination using the return value of strlcpy() (which reports the source le...

EUVD-2026-55623

entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...

CVE-2026-18370

entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies command-line arguments into it. It advances the destination pointer based on the return value of strlcpy, which returns the total length of the...

Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

CVE-2026-19332

A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability is an unknown functionality of the component runopenlane/viewwaveform. The manipulation of the argument designname/vcdfile leads to command injection. Local access is required to approach this...

EUVD-2026-54800

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71947 D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in...

CVE-2026-71946 D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71946

D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108 are affected by a command-injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject commands into the host field, achieving root-level command execution. Remediati...