NPM: VM2 Has Sandbox Breakout Through Inspect Function

NPM: VM2 Has Sandbox Breakout Through Inspect Function vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.3...

EUVD-2026-26986

VM2 Has Sandbox Breakout Through Promise Species...

CVE-2026-4304

The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL Injection via the 'consent' parameter in all versions up to, and including, 3.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2026-27313

Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware uses only the request path and does not include the query string. As a result, requests for the same path with different query parameters can share a cache key...

DarkSword Malware

DarkSword is a sophisticated piece of malware--probably government designed--that targets iOS. Google Threat Intelligence Group GTIG has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, ...

CVE-2026-40797

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Saleswonder LLC WebinarIgnition allows Blind SQL Injection. This issue affects WebinarIgnition: from n/a through 4.08.253...

CVE-2026-7823

creationtimestamp| type| source ---|---|--- 2026-05-05 06:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ml3j3upp6r26 2026-05-05 06:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116520440829606859 2026-05-05 07:06:14+00:00| seen|...

CVE-2026-5294

creationtimestamp| type| source ---|---|--- 2026-05-05 04:30:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116520086781199288 2026-05-05 04:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ml3e2ul6oy2l 2026-05-05 06:24:42+00:00| seen|...

ROS-20260505-73-0044

Vulnerability in python3.13 related to failure to take measures to neutralize crlf sequences. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

RHEL 9 : python3.11 (RHSA-2026:13692)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:13692 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents

Coding agents often pass per-prompt safety review yet ship exploitable code when their tasks are decomposed into routine engineering tickets. The challenge is structural: existing safety alignment evaluates overt requests in isolation, leaving models blind to malicious end-states that emerge from...

Fedora 43 : chromium (2026-af3f470d38)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-af3f470d38 advisory. The updates include fixes for: Critical CVE-2026-7363: Use after free in Canvas Critical CVE-2026-7361: Use after free in iOS Critical CVE-2026-7344...

Fedora 43 : firefox / nss (2026-c0a4f03150)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-c0a4f03150 advisory. Update NSS to 3.122.1 Update to Firefox 150.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

ROS-20260505-73-0058

Vulnerability in python3.12 related to insufficient neutralization of special elements in a request. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

ROS-20260505-73-0055

Vulnerability in python3 related to insufficient neutralization of special elements in a request. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

ROS-20260505-73-0056

Vulnerability in python3.10 related to insufficient neutralization of special elements in a request. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

Oracle Linux 7 : python3 (ELSA-2026-9745)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-9745 advisory. 3.6.8-21.0.11 - Security update CVE-2026-4519 Orabug: 39246828 Tenable has extracted the preceding description block directly from the Oracle Linux security...

ROS-20260505-73-0008

Vulnerability in python3.12 related to insufficient input validation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CoreDNS 安全漏洞

CoreDNS is a DNS server within the CoreDNS community. Versions of CoreDNS prior to 1.14.3 contained a security vulnerability. This vulnerability stemmed from the tsig plugin’s trust transfer writer, which relied on TsigStatus for verification instead of performing its own validation. This allowed...

PT-2026-38376

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.2.13.Final Netty versions prior to 4.1.133.Final Description In the HttpClientCodec, inbound responses are paired with outbound requests using queue.poll once per response, including for 1xx responses. When HTTP/1.1...