EUVD-2026-92441

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-88392

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791208722)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791208722 advisory. - Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proce...

EUVD-2026-92785

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-78861

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

AlmaLinux 10 : osbuild-composer (ALSA-2026:66432)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66432 advisory. golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

CVE-2026-88392

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-78862

An issue in the Mercusys AC12 V2 hardware allows a local attacker to achieve arbitrary code execution . This vulnerability is triggered via the UART serial interface located on the device's printed circuit board (PCB) . No specific software versions, remediation steps, or exploit links are provid...

PT-2026-104818

Name of the Vulnerable Software and Affected Versions LibreOffice Calc versions prior to 26.2.5 Description LibreOffice Calc allows linking a cell range to an external data source, with the link saved within the document. An attacker can specify a Java database driver to be loaded from a remote...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

EUVD-2026-92786

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

UBUNTU-CVE-2017-20285

YAML versions before 1.30 for Perl allow a loaded document to trigger...

PT-2026-106050

Name of the Vulnerable Software and Affected Versions HyperShift operator affected versions not specified Description A flaw in the HyperShift operator allows a tenant isolation bypass. The operator copies user-provided Kubernetes configuration kubeconfig secrets into the privileged control plane...

Cisco ASA Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2019-15992)

A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to execute arbitrary code with root privileges on the underlying Linux operating...

CVE-2019-25777

YAML versions before 1.27001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. A perl/glob document names a package and a symbol, and supplies the value assigned to it. Nothing restricts the name, so the target can be @INC or...

Debian dsa-6543 : fonts-opensymbol - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6543 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6543-1 [email protected] https://www.debian.org/securit...

Malicious code in dotenv-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51d22963a1f1fabe3a8b3f54efcb5053761d385486093200765745297ac2bd16 The package impersonates the dotenv API but on module load and again when the bundled CLI runs invokes a function named dispatchAnalytics in...

MAL-2026-17504 Malicious code in dotenv-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51d22963a1f1fabe3a8b3f54efcb5053761d385486093200765745297ac2bd16 The package impersonates the dotenv API but on module load and again when the bundled CLI runs invokes a function named dispatchAnalytics in...

Malicious code in dotenv-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API...