EUVD-2026-73637

Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

ai-tool-poisoning-guard

ai-tool-poisoning-guard Regla de línea base de seguridad mínima para Claude Code, Codex y Cursor. Esta regla gratuita cierra una brecha real en la revisión integrada de cada herramienta. Conjunto completo de reglas + guía de implementación: Enlace de Gumroad — próximamente. Tu asistente de...

nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy Una biblioteca para realizar una limpieza rápida y configurable de HTML proveniente de fuentes no confiables. Otra forma de decirlo podría ser: es una API que te ayuda a asegurarte de que los clientes no suministren código malicioso en el HTML que envían para su perfil, comentarios, etc....

Updated python-linkify-it-py package fixes security vulnerabilities

LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. Fix quadratic complexity in LinkifyIt.match, port of linkify-it 5.0.1 and 5.0.2 upstream CVE-2026-48801, CVE-2026-59887 82 Match validators at a position instead of slicing the tail, needed because Pytho...

CVE-2026-79675

A flaw was found in NLTK. When processing untrusted input for its per-call options parameter in the java function, NLTK fails to validate Java Virtual Machine JVM options. A remote attacker could exploit this by injecting dangerous JVM flags, such as -agentpath or -javaagent, to achieve arbitrary...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

CVE-2026-19795

IBM Qiskit SDK versions 2.1.0 through 2.5.1 are vulnerable to a denial of service when deserializing QPY files . The root cause is improper handling of a specially crafted object during deserialization, which may overflow the available stack space and trigger a segmentation fault , crashing the a...

TOON: Prototype pollution when decoding untrusted TOON input

Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...

GHSA-P95V-992W-H6C3 TOON: Prototype pollution when decoding untrusted TOON input

Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...

CVE-2026-71219

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca with an exponentially-derived size from the untrusted on-disk didepth field without bounds validation. A crafted GFS2 filesystem image with a large didepth value causes stack exhaustion...

CVE-2026-19032

A flaw was found in jackson-databind. When deserializing java.nio.file.Path from untrusted JSON input, the deserializer resolves an attacker-supplied Uniform Resource Identifier URI without restricting the URI scheme. This allows a remote attacker to select and drive an arbitrary registered...

CVE-2026-84368

A flaw was found in joi. This vulnerability, known as prototype pollution, allows an attacker to inject properties into core JavaScript objects by supplying untrusted input directly into schema-construction configuration. Specifically, by using language keys like proto or constructor in custom...

CVE-2026-82404

TOON is a compact, human-readable JSON serialization format for LLM prompts. Prior to 2.3.1 , decoding attacker-controlled TOON data with __proto__, constructor, or prototype keys wrote through the object prototype chain instead of creating own properties, polluting Object.prototype at runtime. T...

EUVD-2026-56285

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats normalizeStats...

CVE-2026-82927

CVE-2026-82927 is an untrusted pointer dereference vulnerability in Samsung Open Source mTower that allows pointer manipulation . The vulnerability is present in mTower versions prior to commit 06994e303637512e39062f3e037c222e8448e57e. The CVSS 3.1 score is 5.5 (MEDIUM) with a local attack vector...