8125 matches found
CVE-2026-55878 Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest
Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative accepts paths like ../../../etc, a crafted or...
Malicious code in luludawang-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...
CVE-2026-55878: Improper Limitation of a Pathname to a Restricted Directory
Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative accepts paths like ../../../etc, a crafted or...
SPDK is vulnerable to buffer overflow in the NVMe-oF target component
Storage Performance Development Kit SPDK 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf...
PYSEC-2026-1935 SPDK is vulnerable to buffer overflow in the NVMe-oF target component
Storage Performance Development Kit SPDK 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf...
WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.7...
MAL-2026-7086 Malicious code in @mts-pay/web-sdk (npm)
--- -= Per source details. Do not edit below this line.=-...
Exposure of Sensitive Information in mltable
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
PYSEC-2026-1664 Exposure of Sensitive Information in mltable
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...
PYSEC-2026-1261 Microsoft Common Data Model SDK Denial of Service Vulnerability
Microsoft Common Data Model SDK Denial of Service Vulnerability...
WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Austin Ginder in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.4...
sui-txblock-deser-poc
@mysten/sui.js TransactionBlock Deserialization PoC Summar...
PT-2026-56256
Name of the Vulnerable Software and Affected Versions FluxInk Color Management Driver versions 1.0.7.2 through 1.0.7.5 Description The Color Management Driver TcnPeripheral64.sys allows a standard user account to achieve local privilege escalation. This is possible through arbitrary physical memo...
MCP Ruby SDK - Ruby SSE Session Poisoning
Summary Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for...
CVE-2026-48267
DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue...
Malicious Package
Overview theta-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious code in router-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f60a60e68f645bffe7eb5e137979aa6fb6c535c53ee6e13a9fcf01951eb05b55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6873 Malicious code in router-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f60a60e68f645bffe7eb5e137979aa6fb6c535c53ee6e13a9fcf01951eb05b55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary. Home devices became a routing cover. Clean code pulled dirt from a dependency. Identit...