CVE-2026-49484
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/vi
CVSS
—
Sem CVSS
EPSS
0.3%
p22
KEV
—
Exploit Today
7
0-100
Publicado: 12 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-377 · CWE-459
0.2%EPSS · 30 dias0.3%
2026-10-132026-11-06
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1046577.5 ALT—
——0Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.7hCVE-2026-1217503.1 BAI3.8%
——1Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.2dCVE-2026-1221376.7 MÉD1.6%
——0Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp directory to replace the extracted gitstatusd binary, which then executes with the victim's privileges.2dCVE-2026-64672—7.0%
——2Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.3dCVE-2026-1212048.8 ALT24.3%
——7Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)1dCVE-2026-121096—4.3%
——1Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)3d