EUVD-2026-62468

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

CVE-2026-76224 ArcadeDB before 26.8.1 Remote Code Execution via Groovy Fallback

ArcadeDB before 26.8.1 arcadedb-gremlin, affected = 26.7.3 contains a remote code execution vulnerability in its Gremlin query engine. Although the engine defaults to the documented-secure java gremlin-lang engine, ArcadeGremlin.executeStatement silently falls back to the insecure Groovy engine...

httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue

A flaw was found in the moddavfs module of Apache HTTP Server. A WebDAV Web Distributed Authoring and Versioning content author could exploit a path handling issue to directly manipulate trusted DAV property databases. This manipulation could potentially lead to child process crashes, resulting i...

PYSEC-2026-3666 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

CVE-2026-76042

A flaw was found in Google Chrome, specifically within its GPU component, where an uninitialized resource could be used. A remote attacker, after compromising the renderer process, could exploit this by crafting a malicious HTML page. This could allow the attacker to read memory outside of the...

CVE-2026-76033

A flaw was found in Google Chrome's handling of Cross-Origin Resource Sharing CORS. A remote attacker, who has already compromised the browser's renderer process, could exploit this vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass site isolation, a...

BIT-MONGODB-2026-13076 Aggregation Framework Memory Exhaustion Leading to Process Termination

An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...

BIT-MONGODB-2026-13073 MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency...

CVE-2026-76044

A flaw was found in Google Chrome's USB component. A remote attacker, after compromising the renderer process, could exploit a race condition by using a specially crafted HTML page. This could potentially lead to the execution of arbitrary code outside of the browser's security sandbox, allowing...

MAL-2026-14282 Malicious code in mutex-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...

CVE-2026-58086 ktrace(2) privilege incorrectly validated in jails

As an inadvertent side effect of an unrelated code change, PRIVKTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed roo...

CVE-2026-58086 ktrace(2) privilege incorrectly validated in jails

As an inadvertent side effect of an unrelated code change, PRIVKTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed roo...

PyMemoryEditor v2.1.0

PyMemoryEditor A pure-Python library built on ctypes that lets you inspect, modify and search the memory of any running process in a few lines of Python — Cheat Engine workflows on Windows, Linux and macOS! Read, write and scan the memory of any process — straight from Python. One unified API...

Daemonize / Hide Console (PowerShell)

Hide console window and lower process priority before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize / Hide Console PowerShell", "description": "Hide console window an...

Hide Process argv (Python)

Replace process argv0 with an innocuous name on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process argv Python", "description": "Replace process argv0 with an innocuous nam...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

Hide Process argv (Zig)

Replace process name with an innocuous value on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.zig import emithideargv class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process arg...

MAL-2026-14243 Malicious code in flydev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e8d7456b5f0f3d2d3115eed9624272036cad1316cd50ee05e4134e5fa30f8ca The package advertises itself as a generic 'Utility' but ships a purely destructive payload hidden under a deeply nested single-letter directory tree...

Malicious code in flydev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e8d7456b5f0f3d2d3115eed9624272036cad1316cd50ee05e4134e5fa30f8ca The package advertises itself as a generic 'Utility' but ships a purely destructive payload hidden under a deeply nested single-letter directory tree...

MAL-2026-14226 Malicious code in animate-css-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6c86a03c6106e799d0817676fcc92f022b64790aab209aa9fe663c085c4e6 plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a consumer's build instantiate...