CVE ID :CVE-2026-104849 Published : Oct. 2, 2026, 5:17 p.m. | 2 hours, 4 minutes ago Description :Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-104849 - Tinypool: Prototype Pollution Gadget to RCE in run() options

VERWANDTEARTIKEL

CVE-2026-97644 - Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Parameter (v3 /contacts) chained with v4 /emails/test

CVE-2026-92536 - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields

Critical GitLab AI Gateway Vulnerability Enables Remote Code Execution Attacks

CVE-2026-105080 - ConvertX Arbitrary Code Execution

CVE-2026-104433 - Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString

CVE-2026-104476 - Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive