CVE-2026-90001

A flaw was found in the Linux kernel's HID Human Interface Device BPF Berkeley Packet Filter component. A race condition exists between the device destruction and BPF link release paths, which can lead to a struct hiddevice being freed twice. This double-free vulnerability results in a...

MAL-2026-17880 Malicious code in seapy-ops (PyPI)

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden...

Malicious code in seapy-ops (PyPI)

In seapy-ops versions 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, and 1.1.2, an advertised local file analysis tool conceals folder collection and upload commands behind an unlock gate. Once unlocked, it recursively uploads eligible files from the working directory to a configured remote server; a hidden...

CVE-2026-113690

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers...

Exploit for Unchecked Return Value in Google Brotli

Detect · Prove reachability · Understand CVE-2026-111497 — the B...

CVE-2026-119050

Agno versions through 3.1.11 are vulnerable to Code Execution due to an unsafe reflection flaw in PandasTools . The vulnerability occurs when the application uses getattr() with model-controlled function names, allowing an attacker to invoke arbitrary pandas functions. Through prompt injection , ...

CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr. Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled pat...

EUVD-2026-112816

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr. Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled pat...

CVE-2026-119050

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr. Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled pat...

CVE-2026-119050 Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr. Attackers can use prompt injection to make the agent call pandas.readpickle on attacker-controlled pat...

CVE-2026-113691 Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers...

CVE-2026-48196 WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27...

CVE-2026-113690 Stored Cross-Site Scripting in BMC ITSM Attachments

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers...

EUVD-2026-112806

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers...

CVE-2026-113690

The BMC IT Service Management Suite versions 25.3.01 , 25.4.01 , and 26.1.01 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the SmartIT attachment feature . This flaw allows authenticated users to upload malicious script content that can be executed in the browsers of othe...

flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize 32 bits on 32-bit systems, causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an O...

flatpak: Flatpak: Arbitrary code execution via missing symlink protection

A flaw was found in Flatpak. A malicious sandboxed application can exploit missing symlink protection during the creation and bind-mounting of app data directories. By manipulating attacker-controlled path components, a malicious symlink can redirect these directories to arbitrary locations on th...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability (CVE-2026-10859)

Summary IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability due to insecure deserialization of ObjectMessage payloads Vulnerability Details CVEID:CVE-2026-10859 DESCRIPTION: IBM MQ XMS .NET client could allow an authenticated attacker to execute arbitrary code on...

Security Bulletin: IBM MQ is affected by a denial of service vulnerability (CVE-2026-10572)

Summary IBM MQ has addressed a denial of service vulnerability due to a heap buffer overflow when processing MQPUT operations with malformed message options Vulnerability Details CVEID:CVE-2026-10572 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service or...