Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the NodeVM builtin module denylist in lib/builtin.js, which omits childprocess from...

MAL-2026-16285 Malicious code in test899-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...

CVE-2026-75031

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

EUVD-2026-82993

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

CVE-2026-81945

PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) contains a stack-based buffer overflow in its web server. The root cause is insufficient bounds checking on data copied into a stack buffer, allowing a remote administrator to trigger a denial of service or potentially execute arbitrary...

EUVD-2026-82991

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions bfore 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote administrator to cause a denial of service or...

CVE-2026-81945 PLANET IGS-5225-8P2T4S V1/V2 Admin Stack-Based Buffer Overflow via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote administrator to cause a denial of service o...

CVE-2026-81944

The PLANET IGS-5225-8P2T4S industrial managed switch (V1 and V2) contains a stack-based buffer overflow in its web server component, caused by insufficient bounds checking on data copied into a stack buffer. A remote authenticated attacker can trigger a denial of service or potentially execute ar...

CVE-2026-81944 PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of...

CVE-2026-81944 PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web Server

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based buffer overflow in the web server. Insufficient bounds checking on data copied into a stack buffer allows a remote authenticated attacker to cause a denial of...

EUVD-2026-82989

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to execute arbitrary code on the underlying...

CVE-2025-53837 org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2025-53837

XWiki Rendering (org.xwiki.rendering:xwiki-rendering-xml) is affected by an Eval Injection flaw prior to versions 14.10.2 and 15.0 RC1 . Rendering output is included as content of HTML macros without further escaping, allowing an attacker who can edit a document (e.g., their own profile) to close...

GHSA-26VP-8GXG-V4PG org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue

Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...

Eval Injection

Overview org.xwiki.rendering:xwiki-rendering-xml is a library for the XWiki Rendering Engine Affected versions of this package are vulnerable to Eval Injection via the printRaw method in XHTMLWikiPrinter in xwiki-rendering-xml. An attacker can execute arbitrary script macros, including Groovy or...

CVE-2026-7006

Sublime Text for Windows (Build 4192 / ST4 and Build 3207 / ST3) is vulnerable to a local privilege escalation via its update staging mechanism . An unprivileged local attacker can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass clean...

WordPress WP Photo Album Plus plugin <= 9.2.09.002 - Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability

Authenticated Subscriber+ Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.2.09.002...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-45149 DESCRIPTION: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max...

WordPress Save as PDF Plugin by PDFCrowd plugin <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute vulnerability

Authenticated Contributor+ Arbitrary Function Invocation / Code Injection via 'pdfcreatedcallback' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Save as PDF versions = 4.6.1...

CVE-2026-93603

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...