cmd/go: golang: cmd/go: arbitrary code execution via untrusted module proxy

A flaw was found in the Go toolchain cmd/go. When a user works inside a malicious Go project that defines a bogus golang.org/fips140 module and connects to an untrusted Go module proxy GOMODPROXY, the proxy can serve an arbitrary replacement module that still passes local verification. This can...

Malicious code in journey-test-helloshell (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0203fffc73ebe748d6defab0472b648408b29c959a9c6813f966df48cfafb21b setup.py registers a custom install command cmdclass install hook and also fires at module import that connects to the hardcoded bare-IP endpoint...

Exploit for CVE-2026-109618

Php2Shell-POC Pre-auth remote code execution & reverse shel...

Exploit for CVE-2026-109618

🍉 php2shell — CVE-2026-109618 / CVE-2026-109619 Pre-auth re...

CVE-2026-92208

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-92209

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

DEBIAN-CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-92202

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target mus...

CVE-2026-114126

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-114125

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server. Insufficient iframe embedding and message-origi...

DEBIAN-CVE-2026-111183

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2026-111183

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

Exploit for CVE-2026-109618

PHP Vulnerability Exposure Scanner An interactive Bash utilit...

EUVD-2026-107474

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled...

Exploit for CVE-2026-109618

php2shell-check for Claude A passive check for Claude whether...

Exploit for CVE-2026-109618

php2shell-check A passive check for Claude whether a website...

CVE-2026-113870 Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

CVE-2026-113870

MongoDB Compass is vulnerable to arbitrary code execution due to improper escaping of certain BSON values when converting a stored view’s aggregation pipeline into an editable source. An attacker can trigger this by providing a specially crafted view within a MongoDB deployment. If a user connect...

EUVD-2026-107468

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...