EUVD-2026-3719

Malicious code in qdrant-js npm...

EUVD-2026-3721

Malicious code in babel-js npm...

EUVD-2026-3735

Malicious code in connect-web npm...

EUVD-2026-3743

Malicious code in hw-app-eth npm...

EUVD-2026-3744

Malicious code in anthropic-sdk npm...

EUVD-2026-3752

Malicious code in worldposition npm...

EUVD-2026-3765

Malicious code in recaptcha-cors npm...

EUVD-2026-3769

Malicious code in blocks-builder-manifest-generator npm...

EUVD-2026-3771

Malicious code in victim-package-b npm...

EUVD-2026-3716

Malicious code in coolpackage2323 PyPI...

EUVD-2026-3341

HackerOne community member Jad Ghamloush 0xjad has reported an authorization bypass vulnerability in the tracker-delete.php script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts...

EUVD-2026-3338

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...

EUVD-2026-3331

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

EUVD-2026-3357

NVIDIA Nsight Systems contains a vulnerability in the gfxhotspot recipe, where an attacker could cause an OS command injection by supplying a malicious string to the processnsysrepcli.py script if the script is invoked manually. A successful exploit of this vulnerability might lead to code...

EUVD-2026-3359

NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability where an attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering...

EUVD-2026-3402

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages...

EUVD-2026-3379

IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system...

EUVD-2026-3362

IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

EUVD-2026-3368

IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

EUVD-2026-3355

IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...