CVE-2026-68186

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the 'O' or 'C' flag. This happens well before it opens the interpreter. If that open fails the flag stays set...

CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

EUVD-2026-55287

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: set haveexecfd only once the interpreter is opened loadmiscbinary raises bprm-haveexecfd as soon as it sees the 'O' or 'C' flag. This happens well before it opens the interpreter. If that open fails the flag stays set...

CVE-2026-68186

The CVE-2026-68186 issue affects the Linux kernel’s binfmt_misc handling. load_misc_binary() sets bprm->have_execfd when it encounters the O/C flag, before the interpreter is opened, which could cause a NULL dereference in begin_new_exec() if an interpreter open fails and a later format is cho...

CVE-2026-68151 binfmt_elf_fdpic: only honour the first PT_INTERP

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

EUVD-2026-55537

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68151

The CVE-2026-68151 entry concerns the Linux kernel FDPIC ELF binary format driver (binfmt_elf_fdpic). The flaw arises in how the program header scan handles PT_INTERP: the code may break out of the inner switch rather than the outer loop, causing binaries with more than one PT_INTERP to overwrite...

EUVD-2026-54282

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/datainterpreter.py. The manipulation results in code injection. The attack must be initiated from a local position. The exploit has been made public...

CVE-2026-19058

FoundationAgents MetaGPT (up to 0.8.2) contains a code-injection vulnerability in the DataInterpreter function located at metagpt/roles/di/data_interpreter.py. The issue allows local attackers to manipulate input to inject code, with impact on confidentiality, integrity, and availability describe...

CVE-2026-19058 FoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/datainterpreter.py. The manipulation results in code injection. The attack must be initiated from a local position. The exploit has been made public...

EUVD-2026-53308

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

Malicious code in @onereach/time-interpreter (npm)

npm/@onereach/time-interpreter is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11657 Malicious code in @onereach/time-interpreter (npm)

npm/@onereach/time-interpreter is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/phonenumber-interpreter (npm)

npm/@onereach/phonenumber-interpreter is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

JetBrains PhpStorm < 2026.2 Multiple Vulnerabilities

According to its self-reported version, the JetBrains PhpStorm installation on the remote host is prior to 2026.2. It is, therefore, affected by a multiple vulnerabilities. - In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project toolin...

CVE-2026-13435 Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation...

JetBrains WebStorm < 2026.2 Multiple Vulnerabilities

The version of JetBrains WebStorm installed on the remote host is prior to 2026.2. It is, therefore, affected by multiple vulnerabilities: - Arbitrary code execution was possible before granting project trust via project-local linter tooling. CVE-2026-64804 - Arbitrary code execution was possible...

EUVD-2026-48422

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK installpackages...

CVE-2026-16796

Improper neutralization of argument delimiters in the installpackages method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, user...