GHSA-9HC2-HJX8-Q6PV TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a single Git repository import. The vulnerability leverages TiddlyWiki's module system, which automatically discovers and executes JavaScript code embedded in .tid files placed in the...

NPM: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

NPM: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments vulnerability discovered by ? in WordPress Npm n8n-mcp versions = 2.56.0...

CVE-2026-56187

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

CVE-2026-50342

Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

CVE-2026-56187 Windows MIDI Service Module Elevation of Privileges Vulnerability

...

CVE-2026-56183 Windows MIDI Service Module Elevation of Privileges Vulnerability

...

CVE-2026-56183 Windows MIDI Service Module Elevation of Privileges Vulnerability

...

kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proclseek as ones for procreaditer et.al Check pde-procops-proclseek directly may cause UAF in rmmod scenario. It's a gap in procregopen after commit 654b33ada4ab"proc: fix UAF in...

CVE-2026-50342 Windows MIDI Service Module Elevation of Privileges Vulnerability

...

CVE-2026-50342 Windows MIDI Service Module Elevation of Privileges Vulnerability

...

CVE-2026-15392

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The completetablename method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any...

CVE-2026-9636

CVE-2026-9636 affects Rockwell CompactLogix 5380, ControlLogix 5580, and EN4 communications modules. The issue is in CIP Security certificate revocation handling: the controller may fail to reject certificates signed by intermediates that have been revoked via a CRL, potentially allowing a networ...

Windows MIDI Service Module Elevation of Privileges Vulnerability

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

Windows MIDI Service Module Elevation of Privileges Vulnerability

Use after free in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

CVE-2026-15043

CVE-2026-15043 affects DBI::SQL::Nano (versions 1.42–1.650.x) for Perl. In the non-numeric string branch of is_matched, the = with Perl's le, causing inverted = comparisons in WHERE predicates. This occurs in the fallback SQL engine used by DBI's file-backed drivers (e.g., DBD::File, DBD::DBM, CS...

SUSE-SU-2026:2950-1 Security update for perl-HTML-Parser

This update for perl-HTML-Parser fixes the following issue - CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in decodeentities bsc1267606...

MAL-2026-10523 Malicious code in @tabrex/bs58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f8a6402182b6dec89b04f15d70fcdd2b78d678947d49c62a3f09b11a70bf306 @tabrex/bs58 ships the verbatim README, API surface, and repository URL of the legitimate cryptocoinjs/bs58 package package.json declares repository...

EUVD-2026-43574

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hvexts. When building the extension hash via extensions, extensionsbylongname, extensionsbyoid, or hasextensionoid, the code passes OBJobj2txt's return value as the hash-key...

openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21308-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21308-1 advisory. This update for php8 fixes the following issues - Update to versio 8.4.23 - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL...

ROS-20260714-73-0060

The vulnerability of the ngxhttpcharsetmodule module in NGINX Plus and NGINX Open Source web servers relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information or cause...