CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint

Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...

EUVD-2026-58661

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

CVE-2026-19768

CVE-2026-19768 affects Devolutions PowerShell Universal (settings feature) prior to and including 2026.2.3. An authenticated user with settings management permission can cause code injection by writing a crafted setting value that is not properly escaped when written to the settings configuration...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

GO-2026-4352 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2026-4980 vulnerabilities

Vulnerabilities for packages: hubble-fips, kapp-controller-fips, spire-controller-manager-fips, metrics-server-fips, kiali-fips, vitess, cluster-api, flux-image-automation-controller-fips, vault-fips, seaweedfs-operator-fips, prometheus-node-exporter, grafana, argo-workflows-fips,...

GO-2024-3295 vulnerabilities

Vulnerabilities for packages: gh, wolfictl...

DEBIAN-CVE-2026-73417

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

CVE-2026-73417

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

CVE-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

CVE-2026-73502 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-securityhub, crossplane-provider-aws-cloudcontrol, crossplane-provider-aws-mediastore, crossplane-provider-aws-dataexchange, grafana, terraform-provider-grafana, crossplane-provider-aws-licensemanager-fips,...

CVE-2026-72676

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-72676

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-72676

Summary of CVE-2026-72676 : In Fleet Server, Kibana accepted an output-configuration identifier without restricting safe characters, allowing attacker-supplied code to be embedded into a server-side script executed during routine agent policy processing (Code Injection, CWE-94). This could enable...

EUVD-2026-58263

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-72676 Improper Control of Generation of Code in Fleet Server Leading to Code Injection

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

CVE-2026-73652

In vantage6, versions

CVE-2026-73651 TypeORM: migration:generate template-literal code injection

TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in...