MINI-M9CV-VP7H-2G5V

Bulletin has no description...

CVE-2026-76833

The @cgauge/yaml npm package has a custom YAML tag handler that unconditionally calls eval() on attacker-supplied string values during document parsing. Any application that parses untrusted YAML with this library exposes full Node.js runtime authority — environment variables, filesystem read/wri...

EUVD-2026-63350

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

CVE-2026-76833 @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

CVE-2026-18917

creationtimestamp| type| source ---|---|--- 2026-08-20 13:12:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mtjd4cefyr2b...

ECHO-8A36-8D53-BF0C

Bulletin has no description...

CVE-2026-77066

creationtimestamp| type| source ---|---|--- 2026-08-20 12:16:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hxf4xjk6ezdir...

CVE-2026-73198

creationtimestamp| type| source ---|---|--- 2026-08-20 12:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtj75trz4i22 2026-08-20 12:08:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3pxlh6prwitvc...

CVE-2026-18371

creationtimestamp| type| source ---|---|--- 2026-08-20 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mtj5wszvpn2e...

DEBIAN-CVE-2026-77014

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sortranges comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INTMAX. This causes silent omission of requested byte ranges...

CVE-2026-75948

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the image and file fields as raw strings with no output-side HTML-attribute escaping...

ECHO-95FC-7DA4-DF04

Bulletin has no description...

CVE-2026-26032

A flaw was found in Apache Ivy's PackagerResolver. An attacker with access to a packager repository can exploit this by injecting specially crafted module coordinates into ivy.xml files. These malicious coordinates, containing directory traversal sequences, allow the attacker to overwrite files...

BELL-CVE-2026-56684

Bulletin has no description...

BELL-CVE-2026-63639

Bulletin has no description...

BELL-CVE-2026-66046

Bulletin has no description...

BELL-CVE-2026-70907

Bulletin has no description...

BELL-CVE-2026-70906

Bulletin has no description...

BELL-CVE-2026-60589

Bulletin has no description...

CVE-2026-15049

CVE-2026-15049 affects the Depicter — Popup & Slider Builder WordPress plugin in versions prior to 4.8.0 . The plugin's import feature does not validate the type of uploaded files and fails to remove malformed uploads, allowing any user with editor-level access to write an arbitrary file—includin...