EUVD-2026-58238

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-58237

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-73649

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...

Malicious code in @kolbo/mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4967e165bfca294b333ff71265b77d931215a540b48158d2050a4a516ca51e7c src/auth.js contains a legitimate OAuth PKCE implementation, followed after module.exports by a top-level async IIFE that runs when the file is...

Malicious code in prediction-trader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87 index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch variables named iconDomain/getPlugin,...

Malicious code in velora-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb [email protected] exports a getPlugin function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and...

Malicious code in copytrade-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c8773c5727069f87e54d58cd3679252a90ec0fe3de3a1b4adcb9a3bbff68bd index.js exports a getPlugin function that issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108, takes the...

Malicious code in @opezneppelin/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab @opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script scripts/postinstall.js hex-escapes all module...

libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT8BITABGR output format and a specific stride value, leading to a heap-base...

CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

EUVD-2026-58117

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-66256

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-63423

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-63425

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-53790

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...

CVE-2026-63423

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-63423

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-63423

Technical details about CVE-2026-63423 are not publicly available in the provided documents. Monitor for updates from Lenovo and NVD; no affected products, vectors, or mitigations can be confirmed from the supplied sources.

EUVD-2026-58060

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges...