CVE-2026-62968: arsmotorin dreamdisplays: Dream Displays provides in-game screens for streaming videos in Minecraft

Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to yt-dlp under specific conditions. Unintended command-line options may be interpreted by yt-dlp, potentially altering its behavior. This issue ...

CVE-2026-118249 Highcharts: series column construction writes to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable proto and constructor keys from parsed point objects can therefore direct integer-indexed writes to...

CVE-2026-118249

The Highcharts JS charting library (versions 13.0.0 to 13.1.0 ) is vulnerable to Prototype Pollution (CWE-1321). The flaw occurs because the library builds series data columns using point option keys directly as column IDs. This allows own enumerable — specifically —proto— and constructor keys fr...

CVE-2026-118249 Highcharts: series column construction writes to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable proto and constructor keys from parsed point objects can therefore direct integer-indexed writes to...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.19 Vulnerability Details CVEID:CVE-2026-101898 DESCRIPTION: Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings an...

CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2025-0478

Software installed and run as a non-privileged user may conduct improper GPU system calls to issue reads and writes to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kerne...

CVE-2001-1366: Undefined Security Weakness

netscript before 1.6.3 parses dynamic variables, which could allow remote attackers to alter program behavior or obtain sensitive information...