PT-2026-58624

Name of the Vulnerable Software and Affected Versions Microsoft Extensible Storage Engine affected versions not specified Description Improper access control in the Extensible Storage Engine ESENT allows an authorized attacker to elevate privileges locally, which can lead to full system compromis...

PT-2026-60596

Name of the Vulnerable Software and Affected Versions Windows Backup Engine affected versions not specified Description A race condition occurs in the Windows Backup Engine due to improper synchronization when using a shared resource. This allows an authorized attacker to elevate privileges local...

PT-2026-58739

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.125 Description An inappropriate implementation in the V8 JavaScript engine allows a remote attacker to execute arbitrary code within a sandbox by inducing a user to visit a crafted HTML page...

PT-2026-58385

Name of the Vulnerable Software and Affected Versions Windows Backup Engine affected versions not specified Description A use-after-free condition in the Windows Backup Engine allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs when...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-2646)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2026-2686)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...

PT-2026-58738

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.125 Description An inappropriate implementation in the V8 JavaScript engine allows a remote attacker to bypass the same origin policy, a security mechanism that restricts how a document or script load...

PT-2026-58733

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.125 Description An uninitialized use in the V8 engine allows a remote attacker to obtain potentially sensitive information from process memory by using a crafted HTML page. V8 is the open-source...

MAL-2026-10474 Malicious code in @dervix/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118dd8f5224b1dcccddf25d74c6c9fe3543b444173ea293dafa28154e82689d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @dervix/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118dd8f5224b1dcccddf25d74c6c9fe3543b444173ea293dafa28154e82689d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10476 Malicious code in @gleamkit/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008464ca4d7ba15b4b8c6d3a979586c61bd527aef3a209571d28c0ba912403ae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @gleamkit/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008464ca4d7ba15b4b8c6d3a979586c61bd527aef3a209571d28c0ba912403ae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PYSEC-2026-2648 MindsDB has an Improper Access Control Issue

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byomhandler/procwrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit ha...

PYSEC-2026-2975 PyBlade: SSTI/RCE via Bypassed AST Validation in sandbox.py

A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. The affected element is the function issafeast of the file sandbox.py of the component AST Validation. Such manipulation leads to improper neutralization of special elements used in a template engine. The attack may...

PYSEC-2026-2373 Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine

Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the...

MAL-2026-10404 Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

MAL-2026-10414 Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

CakePHP 5.3.7 Released

CakePHP 5.3.7 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 5.3.5. This is a maintenance release for the 5.3 branch that fixes community reported issues and three security issues. Advisories will be published for the issues over the next week as...

Windows Defender <= 1.1.26050.11 Elevation of Privilege (RoguePlanet) (CVE-2026-50656)

The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to or equal to 1.1.26050.11. It is, therefore, affected by an elevation of privilege vulnerability: - Improper link resolution before file access 'link following' in Microsoft Defende...