PT-2026-116213

Уязвимость компонента FRM Metadata Handler системы управления базами данных MariaDB связана с некорректной проверкой указанного индекса, положения или смещения во входных данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

ROS-20260907-73-0076

The vulnerability in dotnet10.0 is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

WAD (Web Access Daemon) Code Execution

The vulnerability of WAD Web Access Daemon in FortiOS operating systems is related to buffer overflow in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created sockets...

Siman Executable Code Execution

The vulnerability of the exprt.exe executable component of the Siman software for discrete event simulation and automation in Rockwell Automation Arena lies in the issue of out-of-buffer writing. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially...

Siman software Code Execution

The vulnerability of the model.exe executable file of the Siman software for discrete event simulation and automation in Rockwell Automation Arena lies in buffer overflow attacks. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially created malicious...

APSB26-146 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves a critical vulnerability that could result in arbitrary code execution. Adobe is aware of CVE-2026-75650 being exploited in the wild...

VulnCheck KEV: CVE-2023-37569

This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system. Successful exploitation of this vulnerability could allow the attacker ...

CVE-2026-75650: Improper Neutralization of Special Elements Used in a Template Engine

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

PT-2026-86933

Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0 Description Failure to validate the settings.lsp.languages binary field in project configuration files allows the execution of arbitrary binaries. An attacker can achieve this by crafting a malicious...

Fortinet FortiClient DNS Modification Code Execution

The vulnerability of the Fortinet FortiClient Windows security tool lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to remotely alter or forge DNS responses for the target host and execute arbitrary code using specially...

Palo Alto Networks GlobalProtect App PLAP Code Execution

The vulnerability of the Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect App, which enables secure remote access to data, is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with SYSTEM privilege...

SIPROTEC 5 File Upload Code Execution

The vulnerability of SIPROTEC 5 devices for relay protection, automation, and control is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause service failures...

Malicious code in dolyame-ui-group (npm)

Source: amazon-inspector 714598919807b4143a734772e690ff94aa986fb6cf61bd99026e7f7bc93f4cf2 On require of the package's main entry, loader.js runs a platform-detecting downloader that fetches an executable from obfuscated hostnames reconstructed at runtime via array-join splits...

Malicious code in dolyame-ui-icon (npm)

Source: amazon-inspector 15f91ac3c4278628875a5c009c515bcdb5fbc8b885eb32dff56e4367c5babf66 On require, index.js loads bootstrap.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints hostnames assembled at runtime via string-splitting/Array.join, e.g...

Malicious code in dolyame-ui-constants (npm)

Source: amazon-inspector 55e6fcb5f8524548ac64acbf658f83a4b610700e0201d3ffe225fcd9d34f7ae2 On require of the package, index.js loads support.js which assembles Cloudflare Workers hostnames via split-string concatenation "oob-work","er.cf101-adf.workers.d","ev".join"", plus cf102-baf and cf103-070...

Malicious code in dolyame-boxy-mobile-bnpl-title (npm)

Source: amazon-inspector 180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2 index.js unconditionally requires./setup on module load. setup.js branches on process.platform linux/darwin/win32, fetches an opaque binary from Cloudflare Workers hosts whose names are assembled at runtime...

Malicious code in dolyame-ui-button (npm)

Source: amazon-inspector db5cddb74df42d94fc066ba42a052c4cbe1cd5ca87de968a7684fab3694fba66 Package advertises itself as a React UI button but its index.js unconditionally requires bootstrap.js on module load. bootstrap.js downloads a platform-specific binary from string-array-obfuscated Cloudflare...

Malicious code in dolyame-ui-calendar (npm)

Source: amazon-inspector 1110e4e32da50573666c0e5f281db639994fad22ed178e2039b9689cc350c284 The package advertises itself as a zero-dependency React calendar component library, but on require of index.js it loads shim.js, which selects a platform-specific path, fetches an opaque binary from...

Malicious code in devplatform-spa-plugin-module (npm)

Source: amazon-inspector 638c4246220ea7f9a595c145c76940e7e060920ef251ab2c67ca814b9ab93378 On require of the package's main entry, polyfill.js executes init which reconstructs destination hostnames via array-join string splits e.g. "oob-worke","r.cf100-416.worker","s.","dev".join"", selects a...

Malicious code in devplatform-react-scripts (npm)

Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev,...