Improper Encoding or Escaping of Output

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains special...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the stringify function when the allowEmptyArrays option is enabled. When an object key contains...

CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qodemembershipcheckfacebookuser AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within t...

CVE-2026-92885 Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qodemembershipcheckfacebookuser AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within t...

CVE-2026-92885

The Qode Membership plugin for WordPress (versions up to and including 2.0.6.2 ) is vulnerable to an Authentication Bypass leading to Account Takeover . The root cause is a typographic error in the qode_membership_login_user_from_social_network function where the code checks an undefined variable...

EUVD-2026-110640

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qodemembershipcheckfacebookuser AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard within t...

CVE-2026-16521

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted...

CVE-2026-16521

A command injection vulnerability exists in the Supermicro BMC syslog feature due to insufficient input filtering. An attacker can inject a command payload into a BMC function, which may execute when the associated service restarts. This flaw is associated with CWE-78 and has a CVSS 3.1 score of ...

EUVD-2026-110621

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted...

CVE-2026-16521 Supermicro BMC's syslog feature contains a command injection vulnerability

An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted...

webkitgtk: use-after-free of JSCValue function parameters

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption...

Critical: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: Vulnerabilities in IBM Semeru Runtime affect Rational Business Developer

Summary There are vulnerabilities in IBM Semeru Runtime used by Rational Business Developer. Rational Business Developer has provided fixes for the applicable CVEs. Vulnerability Details CVEID:CVE-2026-70906 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with networ...

NimDllSideload

Nim DLL Sideloading This repo allows you to easily generate Nim DLLs you can use sideloading/proxy loading. If you're unfamiliar with what DLL sideloading is, take a gander at this blog post. How do I use this? Put the legit DLL or multiple DLLs you want to proxy into the build directory of this...

venom-rs

Shellcode Reflective DLL Injection sRDI in Rust Codename: Venom Shellcode reflective DLL injection sRDI is a process injection technique that allows us to convert a given DLL into a position-independent code which can then be injected using our favourite shellcode injection and execution techniqu...

CVE-2026-107157

A flaw was found in Qt. An out-of-bounds read vulnerability exists in the QCborValue::fromCbor function when parsing malformed Concise Binary Object Representation CBOR data. By convincing an application to process specially crafted CBOR input, an attacker could cause an application crash leading...

Exploit for CVE-2026-93328

The layer CVE-2026-93328 was missing CVE-2026-93328 / GHSA-...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in DOMPurify (CVE-2026-65904, CVE-2026-65911)

Summary Multiple vulnerabilities in the DOMPurify library CVE-2026-65904, CVE-2026-65911 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.4.12 on Windows and version 3.4.13 on Linux. Vulnerability Details CVEID:CVE-2026-65904 DESCRIPTION:...

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities KEV catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...