RHEL 8 : mariadb:10.11 (RHSA-2026:33464)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33464 advisory. MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fixes: mariadb: MariaDB Server:...

SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2026:2673-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2673-1 advisory. Security issues: - CVE-2026-3039: BIND 9 server memory exhaustion during GSS-API TKEY negotiation bsc1265591. ...

AlmaLinux 8 : perl:5.32 (ALSA-2026:30851)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:30851 advisory. perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-IO-Compress: perl-IO-Compress:...

cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted requestkey payload to trick the root-own...

perl:5.32 security update

An update is available for module.perl-ExtUtils-MakeMaker, perl-CPAN-Meta, module.perl-JSON-PP, perl-HTTP-Tiny, perl-IO-Socket-IP, module.perl-experimental, module.perl-MIME-Base64, module.perl-bignum, module.perl-Compress-Raw-Zlib, perl-Data-Dumper, module.perl-Math-BigRat, perl-Pod-Escapes,...

Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

SummaryDjango-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting appropriate component requests and feedin...

PYSEC-2026-329 Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass

Summary Django-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality setpropertyvalue, which can be remotely triggered by users by crafting appropriate component requests and feedi...

Malicious code in @thone33/core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05561d1a31165dab72c5090437ccfa7a85035a2b4fdf6a646eca59b62dd87120 @thone33/core-utils 1.0.4 is a loader stub. Its main entry index.js imports activate from the same-author dependency @thone33/analytics-injector and...

MAL-2026-6564 Malicious code in @thone33/core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05561d1a31165dab72c5090437ccfa7a85035a2b4fdf6a646eca59b62dd87120 @thone33/core-utils 1.0.4 is a loader stub. Its main entry index.js imports activate from the same-author dependency @thone33/analytics-injector and...

perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access

A flaw was found in perl-Archive-Tar. Versions before 3.08 for Perl are vulnerable to a path traversal issue. An attacker can craft a malicious tar archive containing symlinks with targets outside the intended extraction directory. This vulnerability allows the attacker to read or write to...

perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob

A flaw was found in perl-IO-Compress, a component used for data compression and decompression. A remote attacker could exploit this vulnerability by crafting a malicious input, specifically an output glob, that bypasses the intended security measures. This could lead to the execution of...

RockyLinux 8 : perl:5.32 (RLSA-2026:30851)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:30851 advisory. perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-IO-Compress: perl-IO-Compress:...

Important: perl:5.32 security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-IO-Compress: perl-IO-Compress: Arbitrar...

RHEL 8 : perl:5.32 (RHSA-2026:30851)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:30851 advisory. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes:...

PT-2026-53421

Summary Django-Unicorn is vulnerable to python class pollution vulnerability, a new type of vulnerability categorized under CWE-915. The vulnerability arises from the core functionality set property value, which can be remotely triggered by users by crafting appropriate component requests and...

WEB-EXPLOITATION-ARSENAL-v1.0

Web Exploitation Arsenal v1.0 A comprehensive, modular web ap...

XFinder

XFinder External Attack Surface Management EASM — a l...

WR41TH

WRAITH Offensive Security Framework — an all-in-one, menu-driven...

GHSA-X6FG-52VR-HJ4W Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...