PT-2026-24223

A vulnerability has been identified in SICAM SIAPP SDK All versions V2.1.7. The affected application builds shell commands with caller-provided strings and executes them. An attacker could influence the executed command, potentially resulting in command injection and full system compromise...

Siemens SICAM SIAPP SDK 安全漏洞

Siemens SICAM SIAPP SDK is a software development kit from Siemens, Germany. The Siemens SICAM SIAPP SDK suffers from a command execution vulnerability that can be exploited by attackers to cause command injection and full system cracking...

The vulnerability of the rtw89 component in the Linux operating system’s kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the rtw89 component in the Linux operating system’s kernel is related to the use of memory after it has been freed. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the vhosttask.c component in the Linux operating system allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the vhosttask.c component in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of Containerd’s execution environment, related to improper execution permissions, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Containerd execution environment is related to improper execution permissions. Exploiting this vulnerability can allow attackers to access confidential data, compromise its integrity, and even cause service failures...

The vulnerabilities of the i40e components of the Linux operating system allow attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the i40e components of the Linux operating system’s kernel is related to incorrect calculation of buffer sizes. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the Network Block Device Libnbd tool set relates to the implementation or modification of arguments that allow attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the tools for working with Network Block Device Libnbd is related to the implementation or modification of arguments. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Siemens SICAM SIAPP SDK has multiple vulnerabilities

The SICAM SIAPP SDK is a specialized toolkit designed to help developers build and simulate application containers that run on Siemens-specific hardware platforms. The Siemens SICAM SIAPP SDK contains multiple vulnerabilities that can be exploited by an attacker to compromise a customer-developed...

Malicious code in json-merge-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f16e8d9c37feb30d5a44f7a94620c3a09d182a34cd5ccc1e7c97aaf4a991ab10 The package json-merge-tool was found to contain malicious code. Source: ghsa-malware 4bb041118bdac1123bd722a9b1f99ddb6ca406f7ce80d5de344b2c36614b89e...

CVE-2026-30887

Summary: CVE-2026-30887 affects OneUptime prior to version 10.0.18, where untrusted Playwright/JavaScript code run in Synthetic Monitors is executed inside the insecure Node.js vm module, allowing a prototype-chain escape (this.constructor.constructor) to reach the host process and execute arbitr...

CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

EUVD-2026-10421

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887 OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-30887

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

CVE-2026-25045 Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR Insecure Direct Object Reference due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who...

CVE-2026-25045

Budibase (backend API /api/global/users) is affected by a missing server-side RBAC check allowing Creator-level users to elevate privileges (e.g., promote Tenant Admin, demote Admin, modify Owner) and perform IDOR actions, leading to full tenant compromise. Root cause: RBAC checks not enforced se...

MAL-2026-1293 Malicious code in tw-modern-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5263f4880e1caf988c78cea312bf9087935eadf7367438ca98023d0b03a5ab12 The package tw-modern-ui was found to contain malicious code. Source: ghsa-malware 739792de3e777b4dcdf28cf380425a6e0e3082c65f5f72ff73d4ae60ed685d98 A...

Malicious code in odds-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd711f9267e0e1bd3dc42ff98c117a939f5ffa947f11c5fd3d9aea4bc8a47c1 The package odds-analyzer was found to contain malicious code. Source: ghsa-malware 90239f2eeaa13b5a4c00596bcd6f549ab3948f0b1421e246ce67a7bfa30248d6...

MAL-2026-1292 Malicious code in odds-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd711f9267e0e1bd3dc42ff98c117a939f5ffa947f11c5fd3d9aea4bc8a47c1 The package odds-analyzer was found to contain malicious code. Source: ghsa-malware 90239f2eeaa13b5a4c00596bcd6f549ab3948f0b1421e246ce67a7bfa30248d6...