EUVD-2026-95332

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow...

EUVD-2026-95339

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...

Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

ROS-20261009-73-0091

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-107806: Improper Control of Generation of Code

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

ROS-20261009-73-0542

The vulnerability in the kernel-lt is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code...

ROS-20261009-73-0530

The vulnerability in the kernel-lt is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code...

ROS-20261009-73-0458

The vulnerability in the kernel-lt is related to insufficient control of resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261009-73-0410

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-108906

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, an...

Redis 5.0.7 Lua Sandbox Escape

Redis version 5.0.7 as packaged by Debian and Ubuntu leaves the Lua package global accessible, allowing EVAL scripts to load Lua's io module and execute host commands. The supplied environment and proof of concept demonstrate CVE-2022-0543. https://packetstorm.news/download/234982...

Spring Data Commons 2.0.5 SpEL Injection

Spring Data Commons version 2.0.5 contains a SpEL injection issue in web data binding that can allow crafted request parameter names to execute commands. This proof of concept provides a vulnerable containerized application and demonstration. https://packetstorm.news/download/234975...

Spring Cloud Function 3.2.2 SpEL Injection

Spring Cloud Function version 3.2.2 evaluates the spring.cloud.function.routing-expression request header as a SpEL expression. The supplied proof of concept demonstrates target-side command execution. https://packetstorm.news/download/234973...

PT-2026-108982

Name of the Vulnerable Software and Affected Versions busybox affected versions not specified Description The tar applet contains a flaw in its deferred link-creation handling for symlink and hardlink entries with unsafe targets. The software fails to validate that the resolved destination remain...

PT-2026-109323

Name of the Vulnerable Software and Affected Versions Aegisub versions 3.2.0 through 3.4.2 Description Aegisub automatically loads Automation scripts referenced by the Automation Scripts metadata in ASS subtitle projects without verifying user trust in the scripts or their authors. This allows an...

Linux Distros Unpatched Vulnerability : CVE-2026-107725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization chec...

CVE-2026-108119: Improper Link Resolution Before File Access

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-92705: Improper Neutralization of Null Byte or NUL Character

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by Automation Scripts metadata in ASS subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted AS...

CVE-2026-78797: Improper Control of Generation of Code

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the taskid in tasks-lib.lua...

CVE-2026-7827: Stack-based Buffer Overflow

A stack-based buffer overflow in the RdbLoadEntity function of the RDB graph decoders src/serializers/decoders//decodegraphentities.c in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands for example, against an instance with no password configured to cause a...