161158 matches found
Malicious code in exptred (npm)
The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
MAL-2026-17246 Malicious code in exptred (npm)
The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
MAL-2026-17244 Malicious code in exprrdd (npm)
The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
MAL-2026-17242 Malicious code in express-javascript (npm)
The package express-javascript impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
CVE-2026-84154 Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...
CVE-2026-84154 Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...
Multiple vulnerabilities in Pgpool-II
Overview Pgpool-II provided by Pgpool Global Development Group contains multiple vulnerabilities listed below: Out-of-bounds Write CWE-787 - CVE-2026-92867 Improper Certificate Validation CWE-295 - CVE-2026-92868 Out-of-bounds Write CWE-787 - CVE-2026-92869 Stack-based Buffer Overflow CWE-121 -...
CVE-2026-91096
A flaw was found in proxygen. The WebTransport implementation fails to unregister read callbacks for closed streams before destroying them. This issue results in a use-after-free condition, where the transport attempts to invoke memory that has already been released. A remote attacker can exploit...
CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...
EUVD-2026-88648
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...
CVE-2026-97582
A flaw was found in the Linux kernel's GPIO fan driver. When a device is unbound, pending alarm work is not properly canceled before associated memory resources are freed, resulting in a use-after-free condition. A local attacker could exploit this race condition to cause a Denial of Service DoS...
Lantronix G520 Series Cellular Gateway
ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities...
USN-8841-1: Perl DBI module vulnerabilities
It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-73193, CVE-2026-73194...
USN-8841-1 libdbi-perl vulnerabilities
It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-73193, CVE-2026-73194...
PT-2026-102459
Name of the Vulnerable Software and Affected Versions Apache Karaf versions prior to 4.4.12 Apache Karaf versions prior to 4.5.0 Description Apache Karaf contains a flaw in the KarafMBeanServerGuard which fails to enforce role-based access control RBAC on specific MBean lifecycle operations. The...
CVE-2026-79403: Improper Handling of Insufficient Permissions or Privileges
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...
PT-2026-102823
Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...
FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95277): chromium -- security fixes
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-95339: Use After Free
Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
Important: gvfs
Issue Overview: A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buff...