CLSA-2026-1792140497 ImageMagick: Fix of 18 CVEs

CVE-2026-106571: check the pixel cache nexus size calculation for overflow - CVE-2026-106573: limit macro expansion in the MVG renderer - CVE-2026-106578: fix an invalid free in the MVG decoder by correcting the CheckPrimitiveExtent call - CVE-2026-106579: check the coder name against the...

CVE-2020-0796-RCE-POC

CVE-2020-0796 Remote Code Execution POC c 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes Remote Code Execution POC for CVE-2020-0796 / "SMBGhost" Expected outcome: Reverse shell with system access. Intended only for educational and testing in corporate environments. ZecOps...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-migration A skill for AI coding agents that finds...

Leaktopus

Deprecation Notice Dear Leaktopus Users, We want to inform you that the Leaktopus project will be officially deprecated. After careful evaluation, we have decided to discontinue active development and maintenance of this library. What Does This Mean for You? No New Features or Updates: We will no...

MAL-2026-18250 Malicious code in tailwind-base-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6df8bf1c5e364600fdc4b0e541f718c3509c94d4e3df761ece786b78aa305260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview tailwind-base-buttons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2026-3312)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3312 advisory. Inbound-message resource exhaustion CWE-400 leading to denial of service. No configuration precondition; version applicability is the deciding factor. Affected versions: 9.11.0-9.18.50,...

AlmaLinux 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (ALSA-2026:88164)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:88164 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

Google Brotli 1.2.0 Decoder Out-of-Bounds Write

Google Brotli versions 1.0.3 through 1.2.0 contain an out-of-bounds write in the decoder that may allow memory corruption, denial of service, information disclosure, or remote code execution via crafted compressed input...

AlmaLinux 9.6 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792140497)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792140497 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a...

Amazon Linux 2023 : mariadb1011, mariadb1011-backup, mariadb1011-client-utils (ALAS2023-2026-3289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3289 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Amazon Linux 2023 : brotli, brotli-devel, libbrotli (ALAS2023-2026-3334)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3334 advisory. A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing crafted Brotli input. Successful exploitation may lead to memory corruption and remote code...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2026-3263)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3263 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the...

Amazon Linux 2023 : aspell, aspell-devel (ALAS2023-2026-3275)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3275 advisory. A flaw was found in Aspell. An attacker could achieve arbitrary code execution or cause a Denial of Service DoS by convincing a user to process a specially crafted dictionary file. This issue...

NameTrap: Steering AI Coding Agents toward Security Vulnerabilities Via Variable Names

AI coding agents routinely clone repositories, install packages, and read source code obtained from the Web, so publicly hosted code becomes part of the context that shapes the code they write. We show that this Web-borne context can be weaponized without any explicit instruction. We present...

PT-2026-122937

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restriction of excessive...

PHP 8.3.30 Remote Code Execution

PHP version 8.3.30 contains out-of-memory handling and stale request-state flaws that can lead to remote code execution. PHP version 8.3.36 fixes the issues...

GitLab 19.5.0 Integer Overflow Detection Tool

This tool assesses GitLab CE/EE version exposure to an integer overflow that can permit unauthenticated remote code execution and triages local exception logs for related indicators...

Citrix NetScaler ADC and Gateway 14.1-73.36 DTLS Configuration Check

Citrix NetScaler ADC and Gateway versions before 14.1-73.37 and 13.1-64.23 contain a DTLS-enabled memory overflow vulnerability that may lead to remote code execution or denial of service. This tool evaluates reported builds and exported DTLS configuration offline...

NetScaler ADC and Gateway 14.1-73.36 Remote Code Execution

NetScaler ADC and Gateway versions before 14.1-73.37 and 13.1-64.23 contain an unauthenticated remote code execution vulnerability due to improper input validation...