CVE-2026-27206 Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When...

CVE-2026-27119

svelte is a performance oriented web framework. In certain circumstances, the server-side rendering output of an element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected. Mitigation Mitigation for this issue is eith...

CVE-2026-27121

svelte is a performance oriented web framework. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious...

CVE-2026-27125

svelte is a performance oriented web framework. Server-side rendering, attribute spreading on elements e.g. enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside ...

CVE-2026-2492

A flaw was found in TensorFlow. This vulnerability allows a local attacker to escalate privileges and execute arbitrary code. The flaw exists within the HDF5 library's handling of plugins, which are loaded from an unsecured location. An attacker with low-privileged code execution can exploit this...

CVE-2026-27122

svelte is a performance oriented web framework. When using in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side...

CVE-2026-2044

A flaw was found in GIMP. This uninitialized memory vulnerability allows a remote attacker to execute arbitrary code on affected installations. Successful exploitation requires user interaction, where the target must open a specially crafted PGM Portable Graymap image file. This can lead to...

CVE-2026-2048

A flaw was found in GIMP. A remote attacker can exploit this out-of-bounds write vulnerability by tricking a user into opening a specially crafted XWD X Window Dump file. This issue occurs due to improper validation of user-supplied data during XWD file parsing, leading to a write past the end of...

CVE-2026-0797

A flaw was found in GIMP. This vulnerability, a heap-based buffer overflow, occurs during the parsing of ICO files. A remote attacker can exploit this by convincing a user to open a malicious file or visit a malicious web page, leading to arbitrary code execution. The issue is due to a lack of...

CVE-2026-2047

A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the ICNS file parsing component allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, where the target must open a specially crafted malicious file or visit a malicious page. This issu...

CVE-2026-2045

A flaw was found in GIMP. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the conte...

CVE-2026-25896

A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted XML input. The system incorrectly interprets a dot in a DOCTYPE entity name as a regular expression wildcard during processing. This allows the attacker to bypass security measur...

CVE-2026-27026

A flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF file containing a malformed /FlateDecode stream. This stream, which is used for data compression within the PDF, can cause excessively long processing times when...

CVE-2026-27024

A flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed, leads to an infinite loop. This occurs when accessing specific elements within the PDF structure, such as the children of a TreeObject, which can be part of outlines. This vulnerability results in a Denial...

CVE-2026-27025

A flaw was found in pypdf. An attacker can craft a malicious PDF file containing unusually large values in the /ToUnicode entry of a font. When this crafted PDF is processed, for example during text extraction, it can lead to excessive resource consumption, resulting in a Denial of Service DoS du...

CVE-2026-2472

A flaw was found in google-cloud-aiplatform. This Stored Cross-Site Scripting XSS vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript code within a victim's Jupyter or Colab environment. This is achieved by injecting malicious script escape sequences into model...

CVE-2026-2818

A flaw was found in Spring Data Geode. This zip-slip path traversal vulnerability in the import snapshot functionality allows attackers to write files outside the intended extraction directory. This can lead to unauthorized modification of system files or the introduction of malicious content. Th...

CVE-2026-26063

CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networ...

CVE-2026-26318

A flaw was found in systeminformation, a System and OS information library for node.js. This vulnerability allows a local attacker with low privileges to inject and execute arbitrary commands due to unsanitized output from the locate command within the versions function. Successful exploitation c...

Increase in Malware Enabled ATM Jackpotting Incidents across United States

The Federal Bureau of Investigation FBI is releasing this FLASH to disseminate indicators of compromise IOCs and technical details associated with malware enabled ATM jackpotting. Threat actors exploit physical and software vulnerabilities in ATMs and deploy malware to dispense cash without a...