CVE-2026-4500

Summary: CVE-2026-4500 affects bagofwords1 bagofwords (up to 0.0.297). The vulnerability targets the function generate_df in backend/app/ai/code_execution/code_execution.py, enabling injection via manipulation of inputs. The attack could be launched remotely and an exploit is publicly available. ...

CVE-2026-32318

Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Befo...

EUVD-2026-13758

A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been release...

axondeepseg (>=5.0.2 <=5.5.0rc2), bids-manager (>=0.1.0 <=1.0.0) +22 more potentially affected by CVE-2026-32711 via pydicom (>=3.0.0rc1 <=3.0.1)

pydicom PYPI version =3.0.0rc1, =5.0.2, =0.1.0, =1.0.0, =0.1.0, =0.1.8, =0.0.8, =0.0.12 and more Source cves: CVE-2026-32711 Source advisory: SNYK:PYTHON-PYDICOM-15756938...

Improper Access Control.

code.gitea.io/gitea is vulnerable to improper access control. The vulnerability is due to inadequate enforcement of branch deletion permissions after merging a pull request, which allows an attacker to delete branches without proper authorization...

CVE-2026-33125 Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

Frigate is a network video recorder NVR with realtime local object detection for IP cameras. In versions 0.16.2 and below, users with the viewer role can delete admin and low-privileged user accounts. Exploitation can lead to DoS and affect data integrity. This issue has been patched in version...

CVE-2026-33125

Frigate (NVR for IP cameras) has a broken access control vulnerability: in versions ≤0.16.2, users with the viewer role can delete admin and other low-privileged accounts via the API, potentially causing denial of service and compromising data integrity. The issue is addressed in version 0.16.3. ...

MAL-2026-1940 Malicious code in @validates-sdk/v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f6dc99183ad11d3293d19966af14cd33cf7ed4ad00f3de9d6f07e5842a9234 The package @validates-sdk/v3 was found to contain malicious code. Source: ghsa-malware...

Malicious code in decode-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44106748430b9007ab9f143fb8ba25fdd44592016d53029e790975d65bbe5825 The package decode-sdk was found to contain malicious code. Source: ghsa-malware 2a2fc9cdfc8d668581e87f6da2c920cf8a1748aa191910ac5db053a46cbc2282 Any...

CVE-2026-32940

SiYuan Note's CVE-2026-32940 affects versions 3.6.0 and below where SanitizeSVG's blocklist is incomplete, allowing a click-through XSS via the unauthenticated /api/icon/getDynamicIcon endpoint. The endpoint echoes user-controlled input (content) directly into SVG markup using fmt.Sprintf with no...

GHSA-WGVC-GHV9-3PMM vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.12-sdk...

[SECURITY] Fedora 43 Update: dotnet10.0-10.0.104-1.fc43

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

UBUNTU-CVE-2026-22735

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46...

CKAN MCP Server 代码问题漏洞

CKAN MCP Server is an open-source tool developed by onData, designed for natural language queries between AI assistants and open data platforms. Versions of CKAN MCP Server prior to 0.4.85 contained code vulnerabilities. These vulnerabilities stemmed from insufficient validation of the baseurl...

An Agentic Multi-Agent Architecture for Cybersecurity Risk Management

Getting a real cybersecurity risk assessment for a small organization is expensive -- a NIST CSF-aligned engagement runs $15,000 on the low end, takes weeks, and depends on practitioners who are genuinely scarce. Most small companies skip it entirely. We built a six-agent AI system where each age...

The vulnerability of the software for licensing Microsoft Devices Pricing Program allows a violator to execute arbitrary code by enabling unlimited downloading of dangerous files.

The vulnerability of the software for licensing Microsoft Devices Pricing Program relates to the unlimited download of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2026-36474

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the network subsystem regarding the handling of tunneled traffic during IPV6 CSUM GSO fallback. The NETIF F IPV6 CSUM flag only supports checksum offload for packets...

QNAP Systems QuNetSwitch 操作系统命令注入漏洞

QNAP Systems QuNetSwitch is a network management software developed by QNAP Systems, a company based in Taiwan, China. It provides centralized switch management and network configuration monitoring capabilities. Previous versions of QNAP Systems QuNetSwitch, including 2.0.4.0415, had a...

CVE-2026-32191

creationtimestamp| type| source ---|---|--- 2026-03-19 21:23:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgwq6xs252h 2026-03-19 21:23:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgwrf3me42v 2026-03-19 21:23:44+00:00| seen|...

CVE-2026-27166

Discourse is an open source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1 and 2026.1.2, insufficient cleanup in the default Codepen allowed iframes value allows an attacker to trick a user into changing the URL of the main page. This issue has been fixed in versions...