PT-2026-108881

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-107697

A flaw was found in FFmpeg's HTTP Live Streaming HLS demuxer. A remote attacker can exploit this issue by supplying a specially crafted master playlist that references disallowed protocols or local files. This bypasses security restrictions and causes the application to open restricted resources,...

music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...

GHSA-F94X-6692-553Q music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

Summary StsdAtom.get in lib/mp4/AtomToken.ts parses an MP4 stsd sample description box's entry table by advancing a cursor with off += size - 4, where size is a 32-bit, attacker-controlled per-entry length read straight from the file. When size == 0, that advance is 0, so a file declaring a huge...

CVE-2026-25589-25588-25243-23631-23479-REDIS

GUIDE TO CHECKING & REMEDIATING 5 REDIS CVEs AS OF 2026.05.08 Release date: 2026-05-08 Author: TonyCao [email protected] Source: Redis Security Advisory TABLE OF CONTENTS 1. Overview 2. Affected Versions 3. Details of Each CVE CVE-2026-23479 — Use-after-free in Unblock Client Flow...

MAL-2026-17689 Malicious code in @galicia-toolkit/error-master (npm)

@galicia-toolkit/[email protected] claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs on npm install using node postinstall.js || true and sends encoded hostname, working-directory, platform, runtime-version, and username data as DNS...

Malicious code in @galicia-toolkit/error-master (npm)

@galicia-toolkit/[email protected] claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs on npm install using node postinstall.js || true and sends encoded hostname, working-directory, platform, runtime-version, and username data as DNS...

Malicious Package

Overview @galicia-toolkit/error-master is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

CVE-2026-104391

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

EUVD-2026-94252

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-104391 WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-104391 WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

CVE-2026-104391

The ExpressTech Quiz And Survey Master (quiz-master-next) WordPress plugin, versions n/a through 11.2.7 , is vulnerable to Stored Cross-Site Scripting (XSS) . This flaw stems from the Improper Neutralization of Input During Web Page Generation . While the documents confirm the existence of the vu...

WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

EUVD-2026-94227

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows an authenticated user with the Backup Viewer role to modify or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials on the Veeam Backup Server. The issue impacts Veeam Backup & Replication 12.3.2...