A code execution vulnerability exists in the Java integration of Apache OpenOffice versions 4.1.16 and earlier. This flaw allows a crafted untrusted document to execute arbitrary code, potentially including remote code execution, when opened by a user. The issue is addressed in version 4.1.17, currently in release candidate status. Users can mitigate the risk by disabling Java runtime integration or avoiding opening untrusted files until the update is applied.
A buffer overflow vulnerability exists in the WebRTC component of Google Chrome versions prior to 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8.
A use-after-free vulnerability exists in the MediaStream component of Google Chrome versions prior to 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code inside the browser's sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 8.8.
A use-after-free vulnerability exists in the FedCM component of Google Chrome versions prior to 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating and a CVSS score of 9.6, indicating critical impact.
The npm package tailwind-forms-kit@0.5.1 impersonates the legitimate @tailwindcss/forms plugin by using a misleading package name with a leading space, copying the README, and pointing its repository field to the legitimate source. However, its main entry point contains obfuscated code that dynamically fetches and executes arbitrary code from blockchain-hosted transaction data tied to a hardcoded Ethereum address. This allows an attacker controlling that address to execute arbitrary code on any host that installs or requires this package, bypassing typical domain or URL blocklists.
A vulnerability in geelen mcp-remote versions 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper. This issue is identified as CVE-2026-52001 and has a high severity rating with a CVSS score of 7.5. The vulnerability involves unauthorized information disclosure without requiring user interaction or privileges.
A vulnerability in the sequoia-openpgp library allows attackers to bypass key back-signature checks due to incorrect inference of key flags when a key flags subpacket is missing. This enables attackers to illegitimately bind arbitrary subkeys to their own certificate and forge signatures, compromising cryptographic integrity. The vulnerability has a CVSS score of 7.4 (high severity). Red Hat has released security advisories and patches addressing this issue in their hardened images and Red Hat Enterprise Linux 9 distributions.
A command injection vulnerability exists in knowns versions before 0.30.0 due to improper validation of the settings.lsp.languages binary field in project configuration files. This allows attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. The malicious binary path is executed twice under the user's account when a repository with the crafted configuration is opened. The vulnerability has a high severity with a CVSS score of 7.8 and has been patched in version 0.30.0.
CVE-2026-73281 is a medium severity vulnerability in OpenSSH before version 10.5 where certain ssh-agent operations intended to be local can be triggered remotely. Red Hat has issued updates for multiple OpenSSH packages in their Hardened Images RPMs to address this and related vulnerabilities. The vulnerability has a CVSS score of 3.5 and affects various OpenSSH versions including some Ubuntu package versions. A patch is available in OpenSSH 10.5p1-1.hum1. No known exploits are reported in the wild.
Multiple vulnerabilities affecting the Go Toolset in Red Hat Enterprise Linux 8 have been addressed in an important security update. These vulnerabilities impact various Go components including net/mail, cmd/go, html/template, net/http, and net packages. Issues include denial of service, cross-site scripting, arbitrary file overwrite, and integrity bypass. The update fixes these issues to prevent denial of service, security control bypass, and arbitrary file writes. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 8.
CVE-2025-31626 is a high-severity reflected cross-site scripting (XSS) vulnerability in M. Ali Saleem Support Helpdesk Ticket System Lite, affecting versions up to 4.5.2. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers. No patch or official remediation information is currently available.