CVE-2026-26306

The installer for OM Workspace Windows Edition Ver 2.4 and earlier insecurely loads Dynamic Link Libraries DLLs, which could allow an attacker to execute arbitrary code with the privileges of the user invoking the installer...

CVE-2026-26306

The installer for OM Workspace Windows Edition Ver 2.4 and earlier insecurely loads Dynamic Link Libraries DLLs, which could allow an attacker to execute arbitrary code with the privileges of the user invoking the installer...

SUSE CVE-2026-29183

SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynamic icon API endpoint "GET /api/icon/getDynamicIcon" when type=8, attacker-controlled content is embedded into SVG output without escaping. Because the endpoi...

SUSE CVE-2026-30915

SFTPGo is an open source, event-driven file transfer solution. SFTPGo versions before v2.7.1 contain an input validation issue in the handling of dynamic group paths, for example, home directories or key prefixes. When a group is configured with a dynamic home directory or key prefix using...

SUSE CVE-2026-31807

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer SanitizeSVG blocks dangerous elements , , and removes on event handlers and javascript: in href attributes. However, it does NOT block SVG animation elements , which can dynamically set attributes to dangero...

SUSE CVE-2026-31809

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer SanitizeSVG checks href attributes for the javascript: prefix using strings.HasPrefix. However, inserting ASCII tab , newline , or carriage return characters inside the javascript: string bypasses this prefi...

OM Workspace 代码问题漏洞

OM Workspace is a digital collaboration platform developed by the Japanese company OM. Versions of OM Workspace Windows Edition 2.4 and earlier contained code-related vulnerabilities. These vulnerabilities stemmed from the installer’s insecure loading of dynamic link libraries, which could allow...

The vulnerability of the Google Chrome browser’s CSS component, which allows a hacker to trigger a service failure

The vulnerability of the Google Chrome browser’s CSS component is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially created HTML page...

PT-2026-27641

Name of the Vulnerable Software and Affected Versions OM Workspace versions 2.4 and earlier Description The installer for OM Workspace Windows Edition insecurely loads Dynamic Link Libraries DLLs. This could allow an attacker to execute arbitrary code with the privileges of the user running the...

Towards Remote Attestation of Microarchitectural Attacks: The Case of Rowhammer

Microarchitectural vulnerabilities increasingly undermine the assumption that hardware can be treated as a reliable root of trust. Prevention mechanisms often lag behind evolving attack techniques, leaving deployed systems unable to assume continued trustworthiness. We propose a shift from...

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge browsers allows a hacker to induce a service failure.

The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

The vulnerability of PDFium’s components in browsers like Google Chrome and Microsoft Edge allows attackers to trigger a service failure.

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure through the use of a specially created PDF file...

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge browsers allows a hacker to induce a service failure.

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially crafted HTML page...

CVE-2026-4698 JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

MAL-2026-2412 Malicious code in @wame/ngx-frf-utilities (npm)

Malicious package due to JS obfuscation, dynamic code execution, OS/DNS access, suspicious install script, and untrustworthy project. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa63e93a0b5a6ead3de9d3680bb75a023c43b59c6db80e0072b6a239cb7d5da The package...

Malicious code in @wame/ngx-frf-utilities (npm)

Malicious package due to JS obfuscation, dynamic code execution, OS/DNS access, suspicious install script, and untrustworthy project. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa63e93a0b5a6ead3de9d3680bb75a023c43b59c6db80e0072b6a239cb7d5da The package...

Malicious code in @wame/ngx-adfs (npm)

Malicious package due to hex obfuscation, dynamic module loading, process access, suspicious install script, and untrustworthy project. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee67ae68f066d11c3e0625e260c588df3d43384ae91fe74292977ea5304684d9 The package...

MAL-2026-2411 Malicious code in @wame/ngx-adfs (npm)

Malicious package due to hex obfuscation, dynamic module loading, process access, suspicious install script, and untrustworthy project. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee67ae68f066d11c3e0625e260c588df3d43384ae91fe74292977ea5304684d9 The package...

Malicious code in oc-navbar-module-client (npm)

Malicious package due to code obfuscation, dynamic code execution, suspicious email, install script, and low project popularity. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec0eedd88f7d05d96544d4fc778561471c0490c16f2fe2c6e8c70428af92e6ad The package...

MAL-2026-2417 Malicious code in oc-navbar-module-client (npm)

Malicious package due to code obfuscation, dynamic code execution, suspicious email, install script, and low project popularity. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec0eedd88f7d05d96544d4fc778561471c0490c16f2fe2c6e8c70428af92e6ad The package...