PT-2026-95707

Name of the Vulnerable Software and Affected Versions Acode versions 1.11.6 through 1.12.6 Description The com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service without a binding permission, and the TerminalService.java file does not verify the caller. This allows...

PT-2026-95646

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The extension manages partitioned tables by time or ID. The functions run maintenance, show partitions, show partition info, undo partition, and partition data time interpolate the writable part...

PT-2026-95649

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The inherit template properties function manually surrounds primary-key column names from pg attribute.attname with double quotes without escaping embedded double-quote characters. A user with...

PT-2026-95676

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An OS command injection flaw exists in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a...

Tenda W20E Router Arbitrary Command Execution

The vulnerability of the gstruleQos function goform/guestWifiRuleRefresh in the Tenda W20E router microprogramming software is related to the execution of operations outside the buffer in the gstup and gstdwn parameters’ memory. Exploiting this vulnerability allows a remote attacker to execute...

Malicious code in requests-triwes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2026-53557

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

UBUNTU-CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-53534

JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP server is enabled, the GET /better-bibtex/cayw endpoint accepts an external command query parameter and CAYWQueryParams.getCommand passes it through...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

EUVD-2026-82564

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

Malicious code in tailwindcss-form-ui (npm)

Source: amazon-inspector c7a21e4623006a0c69e3dfeb80857eadd9102550c8a77c1d95e880245a5f0fa9 Package name and repository field impersonate the legitimate tailwindlabs/tailwindcss-forms plugin, but the shipped main entry src/index.js is a fully obfuscated obfuscator.io string-array module that has...

CVE-2026-54501

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through...

CVE-2026-52483

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...

Malicious code in lightspark-js (npm)

Source: amazon-inspector d15821a0ef5e30ecb40a14a3e49568a342a372835b2f8b6dbf868217547bcce6 The package lightspark-js was found to contain malicious code. Source: ossf-package-analysis 4280805bd5332d8e03c03090e990b3183e5e724c430fec62738e7e0ca4edfdff The OpenSSF Package Analysis project identified...

Malicious code in libxmlfinal2 (npm)

Source: amazon-inspector cac89e3df77030c41a5f9d5ac7a10bf66dad824ef1d013c47d913be27080f190 The package libxmlfinal2 was found to contain malicious code. Source: ossf-package-analysis eb0047f0752b2dcd9d5f563803f985eaa9c27de216b6e13b137e4e81f62e0dbf The OpenSSF Package Analysis project identified...

Malicious code in ledger-provider (npm)

Source: ossf-package-analysis 213b191babc7191e43f7c5440581518cecd61302d3870b5fbbe6f20266b8e9cf The OpenSSF Package Analysis project identified 'ledger-provider' @ 1337.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

EUVD-2026-82422

Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through...

vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

vim: arbitrary command execution via modeline sandbox bypass

A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the complete, guitabtooltip, printheader options and the mapset function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution...