CVE-2026-112943

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

EUVD-2026-105039

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

CVE-2026-113466

A security vulnerability exists in MinIO (up to RELEASE.2025-10-15T17-29-55Z) within the Embedded Console component. The flaw is located in the globalDeploymentID/SessionTokenAuthenticate function of the cmd/common-main.go file, which leads to the use of a hard-coded cryptographic key . This vuln...

CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

PT-2026-118617

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The PipInvoke.get pip install cmd function handles the --seeder pip --download configuration by calling get wheeldownload=False, which allows pip to consult the configured index. This process...

PT-2026-117221

A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r core cmd str pipe in the library libr/core/rtr http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the...

Nginx-chain-Rift-Poolslip

nginx PoolSlip × Rift — ASLR-independent RCE chain First public chain of two recently-disclosed nginx rewrite-engine bugs into a single ASLR-independent remotesystem on the stock officialnginx:1.30.0 Docker image Debian 13, glibc 2.41 — no hardcoded addresses, no nginx restart, 90 % per fresh...

PT-2026-116944

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet auth challenge nvmet auth challenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A...

BIT-GOLANG-2026-94447 Checksum database bypass for golang.org/toolchain in cmd/go

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical...

BIT-GOLANG-2026-94444 Checksum bypass for golang.org/fips140 in cmd/go

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and...

CVE-2026-82402

Prior to version 0.15.0+dev , Gogs is vulnerable to an Open Redirect in the /redirect endpoint and several post-action flows due to a backslash normalization mismatch. The root cause is in internal/urlx/urlx.go, where the IsSameSite function validates a normalized version of a URL but returns onl...

EUVD-2026-101576

Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the targe...

CVE-2026-82402: URL Redirection to Untrusted Site

Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the targe...

CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTPCOOKIE/X-Cmd results in stack-based buffer overflow. It is...

CVE-2026-109109

A stack-based buffer overflow vulnerability exists in the Settings Export CGI component of Wavlink WL-WN530BE1-A 251117 . The flaw resides in the strcpy function within the /cgi-bin/ExportAllSettings.cgi file, triggered by manipulating the HTTP_COOKIE/X-Cmd argument. This vulnerability can be exp...

CVE-2026-109109: Stack-based Buffer Overflow

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTPCOOKIE/X-Cmd results in stack-based buffer overflow. It is...

CVE-2026-108744

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

CVE-2026-108744

The pbi-cli tool, versions 3.10.1 through 3.12.0 , is vulnerable to an OS command injection within the desktop_sync.py component. The root cause is the passing of unquoted .pbip paths to cmd /c start when reopening projects. An attacker can lure a victim into opening a Power BI project from a spa...

EUVD-2026-96909

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...

CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktopsync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attackers can lure victims into opening a Power BI project from a space-free path containing & to run commands with victim...