CVE-2026-81944: Stack-based Buffer Overflow

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of...

CVE-2026-10027: Out-of-bounds Write

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled...

CVE-2026-82832: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

Tenda FH1201 Router Code Execution

The vulnerability of the formWrlExtraSet/goform/WrlExtraSet function in the Tenda FH1201 router microprogramming system lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service failures...

IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 Multiple Vulnerabilities (7287209)

The version of IBM Cognos Analytics installed on the remote host is 12.0.4 prior to 12.0.4 FP3, or 12.1.x prior to 12.1.3 FP2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7287209: - NLTK versions 3.9.2 and prior are vulnerable to arbitrary...

Tenda F456 Router Code Execution

The vulnerability of the fromNatStaticSetting function in the Tenda F456 router’s microprogramming software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service failures...

CVE-2026-93603: Improper Control of Generation of Code

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93606: Protection Mechanism Failure

vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...

PT-2026-95675

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-10751: Deserialization of Untrusted Data

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling...

PT-2026-95631

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Remote authenticated attackers can execute arbitrary code due to improper neutralization of input during web page generation. Recommendations Apply the available patch for version 12.2...

Malicious code in tailwindcss-form-utils (npm)

Source: amazon-inspector 1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms and mirroring that project's README verbatim, positioning...

EUVD-2026-82483

Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

Impact Ability to run arbitrary code on the server without authentication...

UBUNTU-CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

CVE-2026-93337

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

CVE-2026-45140

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

vim: Vim: Arbitrary Code Execution via crafted directory names

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of...

vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...