Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exprdd (npm)

The package exprdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17246 Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17244 Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

CVE-2026-84154 Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x

A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...

CVE-2026-84154 Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x

A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server...

CVE-2026-91096

A flaw was found in proxygen. The WebTransport implementation fails to unregister read callbacks for closed streams before destroying them. This issue results in a use-after-free condition, where the transport attempts to invoke memory that has already been released. A remote attacker can exploit...

EUVD-2026-88648

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

CVE-2026-97582

A flaw was found in the Linux kernel's GPIO fan driver. When a device is unbound, pending alarm work is not properly canceled before associated memory resources are freed, resulting in a use-after-free condition. A local attacker could exploit this race condition to cause a Denial of Service DoS...

CVE-2021-4034

CVE-2021- Se encontró una vulnerabilidad de escalada de privilegios local en la utilidad pkexec de polkit. La aplicación pkexec es una herramienta setuid diseñada para permitir que usuarios no privilegiados ejecuten comandos como usuarios privilegiados según políticas predefinidas. La versión...

USN-8841-1: Perl DBI module vulnerabilities

It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-73193, CVE-2026-73194...

USN-8841-1 libdbi-perl vulnerabilities

It was discovered that the Perl DBI module did not correctly handle certain integer arithmetic operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-73193, CVE-2026-73194...

CVE-2025-14174-Chrome-Zero-Day

Affected Software: Google Chrome prior to version 121.0.6167.85. Vulnerability Type: Use‑after‑free in the V8 JavaScript engine. Description: A use‑after‑free bug in V8’s garbage collection allows crafted JavaScript to corrupt memory, leading to arbitrary code execution within the browser context...

PT-2026-102604

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists in the DOM: UI Events & Focus Handling component. A use-after-free is a memory corruption flaw that...

PT-2026-102740

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

CVE-2026-84421: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...

PT-2026-102876

🚨 CVE-2026-76732 A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95277): chromium -- security fixes

Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-102327: Incorrect Authorization

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...