163 matches found
PT-2026-134434
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the ' construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers t...
...[ More ]
Rocq Prover versions up to and including 9.2.0 contain a kernel soundness vulnerability in the termination guard checker. Recursive functions involving type transport through the rew construct can corrupt the internal recursive argument tree representation, allowing subsequent fixpoints to be...
PT-2026-111633
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass outline construct in libass/ass render.c...
@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) potentially affected by CVE-2026-108096 via @aws-amplify/data-construct (>=1.7.0-gen2-release.0, <=1.12.0-gen2-migration-1015.0)
@aws-amplify/data-construct NPM version =1.7.0-gen2-release.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =0.11.0 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...
@aws-amplify/backend (>=0.0.0-test-20240319203855, <=0.13.2), @aws-amplify/backend-data (>=0.0.0-test-20240319203855, <=0.11.0) +2 more potentially affected by CVE-2026-108096 via @aws-amplify/graphql-api-construct (>=1.4.0, <=1.20.2)
@aws-amplify/graphql-api-construct NPM version =1.4.0, =0.0.0-test-20240319203855, =0.0.0-test-20240319203855, =1.4.0, =1.0.0, =1.1.111 Source cves: CVE-2026-108096 Source advisory: MEND:CVE-2026-108096...
PT-2026-103654
Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.2 Description A remote attack can be launched by manipulating the type attr argument in the setcos construct fci 44 function within the src/libopensc/card-setcos.c file, leading to a stack-based buffer overflow. A...
Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2v2p-6j97-cjg9. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In...
GHSA-7RR2-8FR3-FJQX Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2v2p-6j97-cjg9. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In...
CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...
CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...
CVE-2026-100722
The vm2 library before version 3.12.2 is vulnerable to a host process termination due to a flaw in the sandbox-to-host construct trap . Specifically, the BaseHandler fails to apply host-side Promise rejection handling when the apply trap calls markHostPromiseHandled() on a returned value, while t...
CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...
CVE-2026-100722: Uncaught Exception
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...
PT-2026-98057
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array access occurs in the construct region function. The function reads the cxled-part variable and uses it to index the cxlds-part array without verifying if the value...
Malicious code in lambda-pipeline-construct (npm)
The package lambda-pipeline-construct was found to contain malicious code. --- Credit: OpenSSF source...
PT-2026-94098
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description Authenticated attackers can cause a desynchronization between stored votes and counters because the Like:: construct function performs counter arithmetic on raw request values before they are validated...
CVE-2026-87986
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...
CVE-2026-80843
Linux kernel IPsec transform (xfrm) subsystem is affected by a memory leak in xfrm_state_construct() . When an authentication algorithm with no sadb_alg_id (e.g., cmac(aes) ) is selected, attach_auth_trunc() allocates x->aalg but leaves x->props.aalgo at zero. The subsequent call to attach_...
Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation
Security evaluations of tool-using agents often equate stored labels with behavioral facts. We audit a preserved campaign by tracing 10,200 execution rows to 180 model-bound requests, 45 semantic requests, and 15 observable stimuli. Two schema treatments were delivered, but the planned external...
CVE-2026-45537 OpenSIPS: Global Buffer Overflow in construct_uri
OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the constructuri function concatenates multiple URI components protocol, username, domain, port, params into a fixed 1024-byte global BSS buffer without any bounds checking. When a routi...