CVE-2026-76036

Affected: Dawn, the open-source WebGPU implementation library bundled in Chrome on Android, versions prior to 151.0.7922.169. Cause: A buffer overflow in Dawn allows writing beyond memory boundaries. Impact: A remote attacker can execute arbitrary code outside the Chrome sandbox by luring a victi...

MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files

Summary The NumpyReader class in monai/data/imagereader.py unconditionally uses np.loadname, allowpickle=True line 1276, enabling arbitrary code execution when loading a crafted .npy or .npz file. This affects all MONAI versions up to and including the latest commit 5b71547. The allowpickle...

Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patch

Summary GHSA-89gg-p5r5-q6r4 claims the pickle deserialization vulnerability in algofrompickle was fixed in v1.5.2. However, monai/auto3dseg/utils.py has not been modified since 2024-07-12 — 18 months before v1.5.2 was released 2026-01-29. All three pickle.loads calls remain unchanged. The fix was...

CVE-2026-12520

The Sierra Wireless HL7800 cellular modem driver drivers/modem/vendorstandalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier parses AT responses with roughly twenty handlers that call netbuflinearizevalue, sizeofvalue, buf, 0, len into a 128-byte stack buffer and then write...

jmespath.php has CompilerRuntime code injection via unescaped function names

Impact mtdowling/jmespath.php can generate and execute attacker-controlled PHP code when JmesPath\CompilerRuntime is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into generated PHP source without sufficient escaping. A crafted expression...

MAL-2026-14131 Malicious code in infogram-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245 [email protected] implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.checkoutputcmd,...

EUVD-2026-61203

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN00432574/FUN0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer...

EUVD-2026-61159

Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never instantiated under the Laravel 11+ skeleto...

CNVD-2020-26585

creationtimestamp| type| source ---|---|--- 2026-08-18 19:00:04+00:00| seen| https://t.me/VulnerabilityNews/41921 2026-08-19 00:00:09+00:00| exploited| https://t.me/VulnerabilityNews/41921...

CVE-2026-74940

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Text component...

CVE-2026-63643

creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:06+00:00| published-proof-of-concept| https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j...

CVE-2026-47630

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

EUVD-2026-61111

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

CVE-2026-47630

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

CVE-2026-47630

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

CVE-2026-47606

NVIDIA Triton Inference Server for Linux has an absolute path traversal flaw exploitable over the network without authentication. CVSS 6.5 MEDIUM; impact is low confidentiality and integrity loss. No exploitation details provided; monitor NVIDIA advisory 5865 for patches.

EUVD-2026-61107

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...

CVE-2026-47606

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...

CVE-2026-71551

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with childprocess.exec. The...

EUVD-2026-61104

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol LLDP daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution...