478331 matches found
PT-2026-95411
Name of the Vulnerable Software and Affected Versions Sublime Text 4 versions prior to Build 4193 Sublime Text 3 versions prior to Build 3208 Description A local privilege escalation issue exists in the update staging mechanism. An unprivileged local attacker can place a malicious DLL in the...
PT-2026-95429
Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.10.2 Description Authenticated workspace members can modify private dashboards belonging to other users because the system fails to verify dashboard ownership. By supplying arbitrary dashboard IDs to the 'update...
PT-2026-95364
Name of the Vulnerable Software and Affected Versions SveltyCMS version 0.0.6 Description Improper access controls exist within the User Attribute Update Endpoint, specifically affecting the file src/routes/api/...path/+server.ts. This flaw allows a remote attacker to manipulate the system due to...
PT-2026-95246
Name of the Vulnerable Software and Affected Versions Tz Weekly Radio Schedule versions prior to 1.8.2 Description The plugin fails to sanitize and escape a parameter used to construct a SQL query within an AJAX action accessible to unauthenticated users. This allows remote attackers to execute S...
CVE-2026-7006: Download of Code Without Integrity Check
Sublime Text for Windows through Build 4192 Sublime Text 4 and Build 3207 Sublime Text 3 contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a...
CVE-2026-93534: Download of Code Without Integrity Check
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...
PT-2026-95509
Name of the Vulnerable Software and Affected Versions spatie Scotty versions prior to 1.4.3 Description A remote attack is possible through the Self Update Handler component. The SelfUpdater::update function in the app/Updater/SelfUpdater.php file allows the download of code without an integrity...
CVE-2026-61550: Missing Authorization
Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...
PT-2026-95495
Name of the Vulnerable Software and Affected Versions WACRM versions prior to 0.7.1 Description The software contains two security issues. First, the profiles update row-level security policy allows authenticated users to modify their own account role and account id variables, which can enable a...
PT-2026-95489
Name of the Vulnerable Software and Affected Versions Capsule versions 0.13.0 through 0.13.6 Description A validation error in internal/webhook/tenant/validation/forbidden annotations regex.go allows a malformed ForbiddenAnnotations.Regex value to bypass validation during a Tenant update. This...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109817)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109817 advisory. FreeRDP before 3.29.0 contains out-of-bounds read vulnerabilities in the async update message proxy for the PolygonSC and PolygonCB primary drawing orders. When...
Malicious code in link-update-jwt-chai (npm)
Source: amazon-inspector 6d19bb2a6946efa9f9c2e4315a157ed2a2d20cf0be24ac89f296e1801214eab5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in library-update-commitizen-jabbah (npm)
Source: amazon-inspector 97f9907c91e0e0fd8eb3295044a11a6a9a0d6513f2fc950b21059db2c7ec5b53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in library-frontend-update-eclipse (npm)
Source: amazon-inspector ed2e4f376bb17f8ffc87980fa0da0d846405540d49493c4df426758297bec270 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in less-loader-update-spica-mongoose (npm)
Source: amazon-inspector 458ef2dc19a186f786aa9fbde9fb2071ebebce6bc29caa9bd74cf4543b1799d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in less-update-kaus-build (npm)
The package less-update-kaus-build was found to contain malicious code. --- Credit: OpenSSF source...
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...
GHSA-9GM5-9RFH-M6VX CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP
Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...
EUVD-2026-80989
CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP...
[SECURITY] [DSA 6506-1] chromium security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6506-1 [email protected] https://www.debian.org/security/ Andres Salomon September 17, 2026 https://www.debian.org/security/faq -...