306065 matches found
EUVD-2026-64963
Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerabili...
CVE-2026-71904
DrayTek VigorAP multiple models are affected by an OS command injection in the tr069TestInform function. The root cause is insufficient filtering of dangerous characters before the event_code field is concatenated into a system command, allowing a remote attacker with valid administrative credent...
Fake GTA 6 Extended Look and demo sites deliver an infostealer
GTA 6 footage really has leaked online, and Rockstar has an official Extended Look coming to Netflix on August 27. But cybercriminals are exploiting the hype with fake Rockstar sites that lead visitors to password-stealing malware. We identified a network of sites appearing in searches for a GTA ...
CVE-2026-77652
A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer allocates a fixed palette with: ren-pPal = gnew0WPGColorRGB, 256; When handling a WPGCOLORMAP record, the parser reads a start index i16 and...
Malicious code in dim-hydration-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51 The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's...
MAL-2026-14429 Malicious code in dim-hydration-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51 The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
gitpython: GitPython: Command Injection via Git option prefix abbreviation
A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
CVE-2026-77658
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...
gitpython: GitPython: Command Injection via Git option prefix abbreviation
A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Exploit for CVE-2026-63039
CVE-2026-63039 — Apache InLong AuditAlertRule ORDER BY SQL i...
MAL-2026-15687 Malicious code in @yuva2210/okx-poc-rce-impact (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124 @yuva2210/[email protected] is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's package.json declares...
Malicious code in @yuva2210/okx-poc-rce-impact (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124 @yuva2210/[email protected] is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's package.json declares...
Malicious code in hydration-ui-dim (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3 On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via...
MAL-2026-14431 Malicious code in hydration-ui-dim (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3 On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via...
MAL-2026-14430 Malicious code in hydration-dim-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...
Malicious code in hydration-dim-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b [email protected] presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's...