EUVD-2026-110462

Seroval: Code injection through a typed array's own constructor property...

GHSA-7RV5-MRXV-XCR9 Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Summary When fromJSON rebuilt an async iterator, it called on on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's o...

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...

CVE-2026-118682 ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

CVE-2026-118682

The KaringX ClashMi application (versions through 1.0.32.1801 ) is vulnerable to a Man-in-the-Middle (MITM) attack because the HttpUtils helper disables TLS certificate validation by default. This flaw allows an attacker controlling a proxy node to intercept HTTPS traffic using any certificate. B...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object proper...

Prototype Pollution

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object property...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via the propertyPath parameter in AccordionMenu.ts, where user-controlled property path segments are applied to an object without validation. An authenticat...

Prototype Pollution

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via Point.setNestedProperty in ts/Core/Series/Point.ts, which splits a dot-separated key path and traverses...

Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw

The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process...

CVE-2026-117997

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget component...

CVE-2026-117602

A flaw was found in Electrum. The external plugin loader does not verify authorization signatures before executing enabled plugins. A local attacker with write access to the application data directory can place malicious plugin code into the plugins folder and enable it in the configuration file...

CVE-2026-115893

A flaw was found in Wasmtime. When compiling WebAssembly Wasm branch table instructions with an unusually large number of targets on 64-bit ARM AArch64 systems, the Cranelift compiler backend generates an incorrect branch target. An attacker supplying a specially crafted WebAssembly module can...

CVE-2026-114053

A flaw was found in vLLM. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution in the server process. By submitting a crafted multimodal request specifying an attacker-controlled code revision, an attacker can cause the application to load and execute...

CVE-2026-112393

A flaw was found in Pillow. When saving compressed Tagged Image File Format TIFF images into memory buffers rather than direct files, the library incorrectly calculates the required memory allocation. A remote attacker who supplies a crafted image for processing can trigger a heap-based buffer...

CVE-2026-78674 Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...

CVE-2026-78674

Multiple WSO2 products are vulnerable to Remote Code Execution (RCE) due to insufficient input validation within the BPMN System REST APIs . An authenticated user can submit crafted requests to execute arbitrary commands on the server with the privileges of the product's runtime account. The pote...

CVE-2026-118683

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...

CVE-2026-118684

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in checkhash that silently returns True when hashval is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...

CVE-2026-118633

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM all versions after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and th...