CVE-2026-71694

An issue in Berkeley Out-of-Order Machine BOOM / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz...

CVE-2026-51366

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the apivedo/chat endpoint and the utentechat parameter...

Important: Red Hat Security Advisory: gegl04 security update

An update for gegl04 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

gimp: GIMP: Arbitrary code execution via heap-based buffer overflow in HDR file parsing

A flaw was found in GIMP. This vulnerability, a heap-based buffer overflow, occurs during the parsing of HDR High Dynamic Range files due to insufficient validation of user-supplied data length. A remote attacker could exploit this by convincing a user to open a specially crafted malicious file,...

CVE-2026-43961 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961

Vim's s:NetrwMarkFile() function in runtime/pack/dist/opt/netrw/autoload/netrw.vim interpolates a directory-listing filename directly into a filter() expression string ('v:val != "'.dname.'"'). A crafted filename with a double quote breaks the literal, allowing arbitrary Vimscript and shell execu...

CVE-2026-43961 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

CVE-2026-43961

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user...

EUVD-2026-62405

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241

stigmem-node 0.9.0a1 lets an operator disable plugin signature enforcement via a single configuration flag without confirmation. If plugin directories are writable by less-trusted users, unsigned malicious plugins can be loaded, causing arbitrary code execution. Upgrade to 0.9.0a2, which requires...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

EUVD-2026-62473

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to...

CVE-2026-76233 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager

Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute...

CVE-2026-76232 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3

Renovate versions from 31.51.0 before 40.33.0 contain a command injection vulnerability in the helmv3 manager where the repository parameter is appended to helm registry login commands without proper sanitization. Attackers with repository write access can craft malicious Chart.yaml files to...

CVE-2026-76231 Renovate 32.135.0 before 40.33.0 Command Injection via hermit

Renovate versions from 32.135.0 before 40.33.0 contain a command injection vulnerability in the hermit manager where user-provided dependency names are appended to install and uninstall commands without proper sanitization. Attackers with repository write access can provide maliciously named herm...

CVE-2026-76230

Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...

CVE-2026-76228 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

EUVD-2026-62462

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

EUVD-2026-62442

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...