CVE-2026-70374: Improper Neutralization of Special Elements used in an OS Command

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

PT-2026-68163

Name of the Vulnerable Software and Affected Versions Bolt CMS affected versions not specified Description Bolt CMS renders content field values using the full Twig application-level Environment without a SandboxExtension. In the src/Entity/Field.php file, the getTwigValue function calls...

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

PT-2026-69023

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

PT-2026-68925

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input to the TypeORM DataSource class, which allows arbitrary options to be set. An attacker can achieve arbitrary code execution on the serv...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input to the TypeORM DataSource class, which allows arbitrary options to be set. An attacker can achieve arbitrary code execution on the server by uploading...

MAL-2026-12022 Malicious code in @keyv/serialize-superjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60fd6f442e95be934353f6974c755757a0693ad83ea1bb5db17d1f555c2663fc Package @keyv/[email protected] shows no a static rule matches and no traced malicious behavior. No install-time lifecycle hooks, network...

voidaccess v2.0.3

VoidAccess Self-hostable OSINT for turning dark-web research queries into structured threat intelligence. Built for security researchers, threat-intelligence teams, and authorized investigators who need collection, enrichment, relationship mapping, and export in one workflow. Terminal Output Quic...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11112 – XXE via SVG Image Upload Program C...

ROS-20260804-73-0033

The vulnerability of the drmschedentitykill function in the Linux operating system is related to insufficient locking of resources. Exploiting this vulnerability can allow a perpetrator to trigger a service failure...

📄 Flowise 3.1.2 Authenticated Remote Code Execution

A proof of concept exploit for an authenticated remote code execution vulnerability in Flowise version 3.1.2. The vulnerability allegedly exists because several record-manager and agent-memory components parse user-controlled additionalConfig JSON and pass its properties directly to a TypeORM...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to disabled SSH host key verification in the EMR SSH helper commands. An attacker can intercept SSH sessions and file transfers by performing a man-in-the-middle attack between the client a...

CVE-2026-18654

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

Security Bulletin: IBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability

Summary IBM QRadar has an XML External Entity XXE injection vulnerability. This vulnerability is not exploitable in all configurations. All of the following conditions must be simultaneously true for a system to be at risk: 1 XML Property Autodetection must be actively enabled on at least one log...

MAL-2026-11506 Malicious code in beaver-ui-date-range-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744905f86e776fde6075a23e40274b0d4798bbb835114506926e0799430c24ba [email protected] declares a postinstall hook node setup.js and additionally triggers the same script from index.js via try...

voidaccess v2.0.1

VoidAccess Self-hostable OSINT for turning dark-web research queries into structured threat intelligence. Built for security researchers, threat-intelligence teams, and authorized investigators who need collection, enrichment, relationship mapping, and export in one workflow. Terminal Output Quic...

name-entity-extraction-for-contextual-embedding (>=0.3.0, <=0.5.0) potentially affected by CVE-2026-9856 via transformers (4.2.0)

transformers PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - name-entity-extraction-for-contextual-embedding =0.3.0, =0.5.0 Source cves: CVE-2026-9856 Source advisory: OSV:GHSA-XRQW-3RRV-VX5W...

XML External Entity (XXE)

veraPDF-validation is vulnerable to an XML External Entity XXE. The vulnerability is due to improper processing of XML external entities in malicious rich-text /RC or /RV entries within a crafted PDF, which allows an attacker to exploit external entity expansion and disclose local file contents...

Malicious code in test-dev-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6205523817ec8f05eccf82a334fa70429c8c326b73c27e031fe991b9abdbdb The package exposes handlers that receive messages over a network connection and dispatch them to shell execution, arbitrary-path file exfiltration,...