990 matches found
PT-2026-72088
Name of the Vulnerable Software and Affected Versions MindsDB Minds Platform versions prior to 26.1.1 Description An unauthenticated remote code execution flaw allows attackers to execute arbitrary OS commands. The issue occurs when crafted prompts are submitted to the unprotected 'POST...
CVE-2026-43627
A flaw was found in llama.cpp. An integer overflow vulnerability exists in the llamabatchinit function due to unchecked multiplications during memory allocation. Attackers can provide specially crafted input parameters, leading to heap corruption. This could potentially allow for arbitrary code...
CVE-2026-19155
A flaw was found in Chromium. This use-after-free vulnerability in the Payments component could allow a remote attacker, who has already compromised the renderer process, to potentially escape the browser's security sandbox. This could be achieved by enticing a user to visit a specially crafted...
CVE-2026-71291
Bolt CMS is affected by a server-side template injection: content fields rendered by Twig are not sandboxed. In Field.php, getTwigValue() renders raw values when shouldBeRenderedAsTwig passes checks (field allow_twig flag and a {{, {%, or # regex), using Twig without sandboxing via createTemplate...
MAL-2026-12250 Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...
CVE-2026-66038
A flaw was found in FFmpeg, specifically within the LCL/ZLIB video decoder. A remote attacker could exploit this vulnerability by providing a specially crafted zlib stream that decompresses to a smaller size than expected. This can lead to the exposure of uninitialized heap memory, including...
CVE-2026-64728
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy...
EUVD-2026-49494
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to bypass network restrictions...
CVE-2026-64728
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy...
CVE-2026-64728
CVE-2026-64728 describes a permissions issue in WebKit/Safari where malicious web content could violate iframe sandboxing policy. The initial description states the issue was addressed with improved validation and is fixed in Safari 26.6, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, vision...
CVE-2026-64728
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy...
EUVD-2026-49488
A permissions issue was addressed with improved validation. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Maliciously crafted web content may violate iframe sandboxing policy...
About the security content of Safari 26.6
About the security content of Safari 26.6 This document describes the security content of Safari 26.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...
VulnCheck KEV: CVE-2026-59821
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to creat...
CVE-2026-65590
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...
TencentOS Server 3: thunderbird (TSSA-2026:0639)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0639 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
PT-2026-61060
A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10...
Amazon Linux 2023 : firefox (ALAS2023-2026-1928)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1928 advisory. Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12...
Arbitrary Code Injection
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Arbitrary Code Injection via the plugin manager process. An attacker can execute arbitrary code by placing a malicious .py file in the plugi...
CVE-2026-61446
CVE-2026-61446 affects PraisonAI before 1.6.78. The plugin manager loads and executes arbitrary Python files from plugin directories using importlib and exec_module without code signing or sandboxing, enabling a local attacker who can write a malicious .py file to achieve arbitrary code execution...