The vulnerability of the NPM packet manager’s vm2 library, related to improper code generation management, allows an attacker to execute arbitrary code.

The vulnerability of the NPM package manager’s vm2 library is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Malicious code in keroeltop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199 [email protected] is a lure package whose index.js runs on every npm lifecycle phase preinstall/install/postinstall/prepare and issues an HTTP reque...

MAL-2026-16297 Malicious code in keroeltop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199 [email protected] is a lure package whose index.js runs on every npm lifecycle phase preinstall/install/postinstall/prepare and issues an HTTP reque...

Malicious code in @insiderintelligence/googleadmanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...

MAL-2026-16290 Malicious code in @insiderintelligence/googleadmanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...

CVE-2026-93872

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93031

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the downloadfiletouploads function. This is due to the import action being registered for...

CVE-2026-84108

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-82340

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System CAS listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause...

CVE-2026-58264

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-11727

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data...

CVE-2026-11716

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data...

CVE-2026-58264 FluidSynth: Heap-based buffer overrun

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

EUVD-2026-83374

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

CVE-2026-58264

FluidSynth , a software synthesizer based on the SoundFont 2 specifications, is affected by an out-of-bounds heap write in its command handler. The pitch_bend_range command accepts a channel argument that is not bounds-checked before writing the supplied value through the selected synth channel. ...

CVE-2026-58264 FluidSynth: Heap-based buffer overrun

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 1.1.2 until 2.5.6, the FluidSynth command handler accepts a pitchbendrange command whose channel argument is not bounds checked before the supplied value is written through the selected synth channel. An out-of-ran...

EUVD-2026-83369

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...