CVE-2026-18958

The CVE-2026-18958 entry concerns imranrisal-dev Student-Management-System. Affected component is the Login function’s loginCheckTest.php where manipulation of username/password parameters leads to SQL injection. The vulnerability is reported as remotely exploitable, with exploit code publicly av...

Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067 On require of this package, index.js loads compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of...

EUVD-2026-53579

There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows...

EUVD-2026-53574

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...

CVE-2026-9196

IBM Langflow OSS 1.0.0–1.10.3 is affected by an authenticated code-execution risk during Agentic Assistant validation caused by improper handling of LLM-generated components. The backend may execute model-generated Python code in the validation step before user approval, enabling an attacker to t...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-51992

A flaw was found in ClickHouse Server. A SQL Injection vulnerability exists in the create dictionaries function, which allows a remote attacker to execute arbitrary code. This could lead to a complete compromise of the affected system...

CVE-2026-17625

Langflow OSS versions 1.0.0–1.10.3 are affected by an OS Command Injection in Model Context Protocol features (MCP). The IBM bulletin describes weaknesses in MCP validation, authentication/authorization enforcement, and request handling that could allow a remote authenticated attacker to execute ...

CVE-2026-9077

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...

CVE-2026-18927

CVE-2026-18927 affects imranrisal-dev Student-Management-System, specifically the Shared Upload Helper’s file student_profile_pic.php function storeProfileImage. An attacker can manipulate the argument choose_file to achieve unrestricted file upload, with the attack executable remotely. The explo...

EUVD-2026-53470

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

CVE-2026-9077

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...

CVE-2026-20268

CVE-2026-20268 concerns Cisco IOS XE software with improper restriction of operations within memory buffer bounds (CWE-119). Affected product: Cisco IOS XE; root cause: memory-safety issue in a memory buffer operation exposed over network. Impact per CVSS: Availability HIGH; Confidentiality/Integ...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

MAL-2026-13251 Malicious code in bigops-status-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...

Malicious code in devplatform-vite-plugin-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev,...

MAL-2026-13278 Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...