39493 matches found
MAL-2026-17323 Malicious code in cortana-md-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...
CVE-2026-103087
Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...
CVE-2026-103087
Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...
CVE-2026-103087
Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...
CVE-2026-103087
The Gosub browser engine (gosub-engine ) is vulnerable to uncontrolled recursion in versions through 0.1.0 and main before commit 46868b3 . An attacker can trigger a Denial of Service (stack exhaustion and application crash) by providing an SVG document with excessively nested elements. The engin...
CVE-2026-103087
Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...
EUVD-2026-89554
Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...
CVE-2026-102142: Improper Neutralization of Special Elements Used in a Template Engine
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...
AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1775646020)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1775646020 advisory. - Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly...
@n8n/ai-workflow-builder (1.42.0), @n8n/backend-test-utils (1.42.0) +7 more potentially affected by unknown CVE via @n8n/workflow-sdk (0.35.0)
@n8n/workflow-sdk NPM version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/workflow-sdk and may be impacted: - @n8n/ai-workflow-builder 1.42.0 - @n8n/backend-test-utils 1.42.0 - @n8n/db 1.42.0 - @n8n/instance-ai 1.27.0 -...
PT-2026-103575
Name of the Vulnerable Software and Affected Versions Kiteworks appliance affected versions not specified Description A system notification template on the Kiteworks appliance is processed by a template engine that evaluates expressions within the stored template body. This allows an authenticate...
Linux Distros Unpatched Vulnerability : CVE-2026-100825
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...
CVE-2026-103087: Uncontrolled Recursion
Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...
Sapien: A Stateful Policy Engine for Autonomous AI Agents
Contextual security defenses prevent AI agents from taking rogue actions by synthesizing a task-specific policy and enforcing it on the agent's tool calls. In multi-step tasks, however, which actions are valid often depends on what the agent has already done and learned. We present Sapien, a poli...
PT-2026-102971
Uncontrolled recursion in the Gosub browser engine gosub-engine through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service stack exhaustion and application crash via an SVG document containing an excessive number of deeply nested elements. Because the engin...
Linux Distros Unpatched Vulnerability : CVE-2026-100814
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, an...
SUSE CVE-2026-97928
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs on VRAM, which amdgputtmmapbuffer reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 e.g...
SUSE CVE-2026-100793
JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...