CVE-2025-53837

XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...

GHSA-26VP-8GXG-V4PG org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

Eval Injection

Overview org.xwiki.rendering:xwiki-rendering-xml is a library for the XWiki Rendering Engine Affected versions of this package are vulnerable to Eval Injection via the printRaw method in XHTMLWikiPrinter in xwiki-rendering-xml. An attacker can execute arbitrary script macros, including Groovy or...

CVE-2026-7006

Sublime Text for Windows (Build 4192 / ST4 and Build 3207 / ST3) is vulnerable to a local privilege escalation via its update staging mechanism . An unprivileged local attacker can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass clean...

WordPress WP Photo Album Plus plugin <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability

Authenticated Subscriber+ Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.2.09.002...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-45149 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max...

WordPress Save as PDF Plugin by PDFCrowd plugin <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute vulnerability

Authenticated Contributor+ Arbitrary Function Invocation / Code Injection via 'pdfcreatedcallback' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Save as PDF versions = 4.6.1...

CVE-2026-93603

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-79294

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component...

Malicious code in sinful (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b1a123340bff39c861a85b61e1af355895b003c99287d61701d66e1b81939b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16284 Malicious code in sinful (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b1a123340bff39c861a85b61e1af355895b003c99287d61701d66e1b81939b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-93606

CVE-2026-93606 affects vm2 (npm) versions 3.12.0 and earlier, specifically the VM and NodeVM sandbox implementations. The root cause lies in lib/bridge.js: the bridge's rejection sanitizer only wraps then/catch rejection slots holding a function, and the Symbol.species/.then neutralization is app...

CVE-2026-93606 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...

CVE-2026-93606 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...

CVE-2026-93606 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...

CVE-2026-93605 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

CVE-2026-93605

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability rated CVSS 10.0 (Critical) . The DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. When NodeVM is configured with builtin:['*'] or an explicit child_process allowance, an attacker ...

EUVD-2026-82898

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

GHSA-J8PX-RMRX-76H9 Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

Caddy v2.11.3 — Three vulnerabilities in handler/placeholder layer Tested against: caddy:2.11.3 official Docker image, SHA verified at runtime Reproduction environment: Docker Desktop 4.73.1 / Engine 29.4.3 on Windows 10 host, isolated containers, no network egress required for any of the exploit...

CVE-2026-4282-Scanner

CVE-2026-4282-Scanner Un escáner de vulnerabilidades no intrusivo, basado en versiones, para CVE-2026-4282 , que afecta a Keycloak y a Red Hat Build of Keycloak RHBK. ⚠️ Descargo de responsabilidad: Esta herramienta está pensada estrictamente para investigación de seguridad autorizada, pruebas de...