Fedora 45 : dracut (2026-5bf73fe397)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5bf73fe397 advisory. - fixdevicetree-firmware: include soc specific firmwares in installgeneric - fixdevicetree-firmware: include Qualcomm X2 laptop model specific firmwares -...

Exploit for Code Injection in Langflow

P...

EUVD-2026-62600

Orval: Import-time RCE via query-parameter default - zod module-level template literal...

EUVD-2026-62596

Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client...

GHSA-6MR6-JVCR-2F25 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

Malicious Package

Overview bellatrix-upgrade-janus-dynamo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview bella-lontong60-breki is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Arbitrary Code Injection

Overview modelscope is a ModelScope: bring the notion of Model-as-a-Service to life. Affected versions of this package are vulnerable to Arbitrary Code Injection due to unsafe YAML deserialization in the model configuration loading paths in modelscope/models/audio/tts/voice.py and...

CVE-2026-58572

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-18808

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

CVE-2026-58572

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-58572

Dell PowerStore is affected by a Code Injection vulnerability (CVE-2026-58572). An authenticated user with limited privileges can exploit this flaw to execute arbitrary code with root privileges , resulting in high impact across confidentiality, integrity, and availability. The attack requires lo...

EUVD-2026-69131

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-58572

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

CVE-2026-18808 Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

CVE-2026-18808

Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) prior to v1.9 is affected by an Improper Control of Generation of Code (Code Injection) vulnerability, enabling unauthenticated remote code execution over the network. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) w...

EUVD-2026-69130

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

CVE-2026-18808 Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO

Improper Control of Generation of Code 'Code Injection' vulnerability in Klemsan Electrical Electronics Inc. KIO Klemsan Internet Objects allows Code Injection. This issue affects KIO Klemsan Internet Objects: before v1.9...

CVE-2026-4813 Code injection in the Lutece Core

A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode FEATURESECUREPROCESSING, allowing Java extension functions to be...

CVE-2026-4813

Lutece Core versions up to 7.1.7 are affected by a code injection vulnerability in the XSL export management module . The root cause is that the XML/XSLT processing configuration does not enable FEATURE_SECURE_PROCESSING , permitting Java extension functions to execute from malicious XSL styleshe...