Malicious code in xzvbailsx (npm)

Source: amazon-inspector ac9176da252791a96b93c24e702c2245fb96d9655cdf9f31d61e9bc3e0c21528 package.json declares the dependency libsignal with source github:tenka-san/libsignal-node, an unpinned GitHub ref with no commit SHA, tag, or integrity hash. On npm install, npm fetches whatever HEAD of tha...

CVE-2026-93467

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

CVE-2026-93467 HGiga｜OAKlouds - Insecure Deserialization

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

CVE-2026-93467 HGiga｜OAKlouds - Insecure Deserialization

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

SUSE CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

PT-2026-102923

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.13 Description The generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In bash and zsh scripts, a crafted virtual...

PT-2026-95471

Name of the Vulnerable Software and Affected Versions IBM MQ for HPE NonStop affected versions not specified Description An authenticated attacker can cause a denial of service or potentially execute arbitrary code. This issue occurs due to improper validation of message distribution list...

PT-2026-95411

Name of the Vulnerable Software and Affected Versions Sublime Text 4 versions prior to Build 4193 Sublime Text 3 versions prior to Build 3208 Description A local privilege escalation issue exists in the update staging mechanism. An unprivileged local attacker can place a malicious DLL in the...

PT-2026-95615

Name of the Vulnerable Software and Affected Versions IBM MQ for HPE NonStop versions 8.1.0 through 8.1.0.40 Description The IBM MQ C client fails to properly validate responses from the queue manager when requesting AMS Application Managed Service policy data. This flaw could allow a remote...

PT-2026-95464

Name of the Vulnerable Software and Affected Versions IBM MQ Appliance affected versions not specified Description A heap buffer overflow occurs during protocol message processing before authentication. This flaw allows a remote attacker to cause a denial of service or potentially execute arbitra...

PT-2026-95470

Name of the Vulnerable Software and Affected Versions IBM MQ affected versions not specified Description An authenticated attacker can cause a denial of service or potentially execute arbitrary code. This issue is caused by an integer overflow, which occurs when an arithmetic operation results in...

CVE-2026-84031: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-82832: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-11727: Heap-based Buffer Overflow

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...

CVE-2026-81944: Stack-based Buffer Overflow

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of...

CVE-2026-81305: Inclusion of Functionality from Untrusted Control Sphere

CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An attacker with physical access to the device could supply a malicious script and execute arbitrary code in the security context of the affected device...

CVE-2026-7006: Download of Code Without Integrity Check

Sublime Text for Windows through Build 4192 Sublime Text 4 and Build 3207 Sublime Text 3 contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a...

CVE-2026-11381: Heap-based Buffer Overflow

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of message distribution list structures...

CVE-2026-10858: Heap-based Buffer Overflow

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

Tenda FH1201 Router Code Execution

The vulnerability of the formWrlExtraSet/goform/WrlExtraSet function in the Tenda FH1201 router microprogramming system lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service failures...