CVE-2026-18606

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...

CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

UBUNTU-CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

GHSA-JJ27-H5HQ-8X99 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

A Cross-Site Scripting XSS vulnerability has been identified in the Angular compiler's internationalization i18n pipeline. Although Angular disallows binding to event-handler attributes such as onclick and onerror through standard attribute validation validateAttribute / validateProperty, the i18...

CVE-2026-69151 Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-69151

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes is caused by the i18n pipeline allowing i18n-onerror and similar attributes to be translated, enabling a lower-trust translation file to replace a benign handler with executable JavaScript. Affected versions are prior to 20.3.2...

EUVD-2026-52369

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-18606

RCE-like local privilege escalation in Razer RzUpdateService 1.10.14.0 via Named Pipe Handler (RzUpdateService.exe). Manipulating lpThreadParameter is reported to cause improper privilege management; requires local access. Publicly available exploit noted; vendor contacted early. No remediation d...

CVE-2026-18606 Razer RzUpdateService Named Pipe RzUpdateService.exe privileges management

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...

EUVD-2026-52351

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...

CVE-2026-18606

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...

netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...

netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS Transport Layer Security ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service DoS due to excessive memor...

CVE-2026-68930

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, serverreadauthenticated, and the execrequest callback. Version 0.62.5 fixes the issue...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses...

CVE-2026-18593

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

CVE-2026-18590 Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2026-18590

The CVE concerns Wavlink WL-NU516U1 (firmware MT7628) where the Admin Password Handler’s function set_sys_adm in adm.cgi is vulnerable to OS command injection. The underlying issue enables a remote attacker to trigger code execution, with the exploit publicly disclosed. Impact is remote, affectin...

CVE-2026-16250

The Personal QR Message WordPress plugin through 1.0 does not restrict the file types that can be uploaded through an unauthenticated handler, allowing unauthenticated users to upload arbitrary executable PHP files that are directly reachable, leading to remote code execution...