CVE-2026-0163

In multiple functions of vpuioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0163

CVE-2026-0163 concerns the Android Video Processing Unit (VPU) driver, where multiple functions in vpu_ioctl.c have a use-after-free defect. This leads to remote elevation of privilege with no additional execution privileges required and no user interaction needed. The issue is categorized in the...

CVE-2026-18830

The CVE-2026-18830 issue affects the Amazon Bedrock AgentCore harness, specifically the InvokeHarness API. It arises from insufficient input validation in, or surrounding, the harness, which could allow an authenticated remote user to execute configured tools by sending crafted content blocks in ...

CVE-2026-15307

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

CVE-2026-69259

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

CVE-2026-64630

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

CVE-2026-24084

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities...

EUVD-2026-52765

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

CVE-2026-58074

CVE-2026-58074 describes a vulnerability that allows a high-privileged attacker to execute arbitrary code on the server. The CVSS 4.0 metrics indicate a network-exposed issue requiring no user interaction and with high impacts to confidentiality, integrity, and availability, while the attacker pr...

EUVD-2026-52760

A vulnerability allowing a high-privileged user to execute arbitrary code on the server...

EUVD-2026-52759

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

EUVD-2026-52757

A vulnerability allowing a low-privileged user to inject SQL and extract database contents...

CVE-2026-64630

A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link...

CVE-2026-58074

A vulnerability allowing a high-privileged user to execute arbitrary code on the server...

CVE-2026-64631

CVE-2026-64631 describes an SQL injection vulnerability exploitable by a low-privilege user that can extract database contents. According to the provided metrics, the vulnerability has HIGH base severity (CVSS 4.0, score 8.5) with network attack vector, low attack complexity, and no user interact...

CVE-2026-69256

Flowise CVE-2026-69256 affects the CSVAgent node prior to version 3.1.3. A user-supplied customReadCSVFunc is evaluated as pd.${customReadCSVFunc} and can execute via Pyodide, bypassing a denylist with a pandas.read_pickle payload. An authenticated user who can create/modify a chatflow can add th...

EUVD-2026-52746

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the CSVAgent node allowed users to provide Python code that is executed through pyodide; although a denylist blocked dangerous Python constructs, pandas.readpickle could deserialize a pickled...

Malicious code in @servicetitan/standalone-ui (npm)

npm/@servicetitan/standalone-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

EUVD-2026-52735

Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities...

WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. id: CVE-2019-9880 info: name: WPEngine WPGraphQL 0.2.3 -...