PT-2026-70921

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use-after-free issue exists within the Extensions component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. An...

PT-2026-70923

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.137 Description A use after free issue in Blink allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. Use after free is a memory corruption flaw...

CVE-2026-73035

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-72913

CVE-2026-72913 affects Kitty terminal (GPU-based, cross-platform) prior to version 0.48.2. The vulnerability arises from misbehavior in the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py, which write unauthenticated data to the child shell’s stdin. The handle_remote_echo path accepts ...

CVE-2026-72913 Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-18620 Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-18620

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount SA during a CreateRun request, an attacker can bypass authorization checks. This...

CVE-2026-53090 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-gcp...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

EUVD-2026-55804

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...

CVE-2026-73035

The CVE-2026-73035 vulnerability affects npm-check-updates up to version 23.0.2. A terminal escape sequence injection flaw exists in dependency homepage/repo URL fields, allowing unfiltered control characters to be emitted to the terminal when using --format homepage or --format repo. This can en...

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030

CVE-2026-73030 affects unearth 0.18.2. The vulnerability arises in the is_within_directory path validation, where path normalization is not performed, allowing ../ sequences and symlink traversal to bypass containment checks. Attackers could craft tar archives with symlink members or traversal se...

CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

CVE-2026-72864

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's...

CVE-2026-72863

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

CVE-2026-70622

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...