MAL-2026-18357 Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" index.js exports a small validateSchema function and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and...

CVE-2026-50096

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

PYSEC-2026-4346

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.openBytesIOdata without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request...

CVE-2026-115915

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.openBytesIOdata without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request...

StealMyBitcoin-PoC

sponsored with ❤️ by Steal My Bitcoin CTF proof of concept One live PHP callback against the Steal My Bitcoin challenge, start to finish, in a single standard-library Python file. This README explains stealmybitcoinpoc.py, a single-file Python reproduction of the request sequence used in my Steal...

CVE-2026-50096 BUG-000187164 - ArcGIS Server has a security vulnerability.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-50096

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 12.1 and prior. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked, can execute arbitrary JavaScript code in the victim's browser. Remediation is available ...

EUVD-2026-110058

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-99083

A flaw was found in the Linux kernel's ksmbd Server Message Block SMB server. When handling compounded SMB requests during Kerberos authentication, the server incorrectly calculates available buffer space, leading to a heap-based out-of-bounds write. A remote attacker could exploit this...

CVE-2026-89078

A flaw was found in Ruby. When compiling a specially crafted regular expression with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, a double free can occur when parsing a pattern that fails after an alternation. This double free causes memory...

CVE-2026-93577

A flaw was found in Ruby. When compiling a specially crafted regular expression with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, an integer overflow in the size of the compiled pattern can occur. This integer overflow causes memory...

CVE-2026-97229

A flaw was found in Ruby. When compiling a specially crafted regular expression with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, an integer overflow in the size of the compiled pattern can occur. This integer overflow causes memory...

Consul vulnerable to an authorization bypass in service mesh registration

Summary HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user with service write permission to apply Envoy escape-hatch configuration without the required mesh write permission. This vulnerability CVE-2026-105608...

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497 , a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code. PHP says the flaw can be reached through the cURL extension when...

CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder

Overview On October 21, 2026, the Node.js Project published a security advisory for CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. The vulnerability affects the Node.js 26.x, 24.x, and 22.x release lines. Node.js rates the issue High, while Google, the CVE...

SUSE CVE-2026-114109

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...

SUSE CVE-2026-115504

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...

Open eClass 3.15 - Remote Code Execution (CVE-2024-26503)

CVE-2024-26503: authenticated unrestricted file upload in /modules/admin/certbadge.php stores a PHP webshell under /courses/userprogressdata/badgetemplates/. !/usr/bin/env python3 -- coding: utf-8 -- """Open eClass CVE-2024-26503 authenticated certbadge icon upload RCE.""" from future import...

DEBIAN-CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...