979766 matches found
SUSE CVE-2026-63317
Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...
Out-of-bounds Write
Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...
GHSA-P5RM-JG5C-8C77 Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Impact Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics statictemplate or the adaptive-card extension x-ai-adaptive-card, the file reference is written into the generated manifest's...
EUVD-2026-44933
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by kiota info...
EUVD-2026-44937
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled...
GHSA-XG2H-5XR2-29JW Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution Impact The Kiota Ruby code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI default fields and property names directly into Ruby...
GHSA-QQ9H-G4JM-XGF3 Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
Am I affected You are affected if all of the following hold: - You run a better-auth version below 1.6.22, or a 1.7.0-beta below 1.7.0-beta.10. - You enable the magic-link plugin or the email-OTP plugin. - You also enable email and password sign-up with open registration. - An account can exist a...
GHSA-H7F2-F9CC-H2GV ImageMagick: Memory Leak in YUV decoder when opening of blob fails
A memory leak will occur when a blob cannot be opened in the YUV decoder...
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's...
USN-8604-1 linux-azure-6.17 vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...
USN-8604-1: Linux kernel (Azure) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Drivers...
CVE-2026-15755
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-15755
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-15755
The CVE concerns the WordPress plugin Open User Map – Interactive Leaflet Maps (affected versions up to and including 1.4.45). It describes a Stored XSS via shortcode attributes caused by insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access ...
CVE-2026-15755 Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-48506
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
MAL-2026-11041 Malicious code in @daylightqc/date-fmt-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...
