Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

CVE-2026-23744 – MCPJam Inspector Unauthenticated RCE PoC...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

PT-2026-69852

Name of the Vulnerable Software and Affected Versions OpenCart version 4.2.0.0 Description The extension installer fails to validate that extracted paths from uploaded .ocmod.zip files remain within the intended directory. This allows an attacker to use directory traversal sequences, such as ../,...

CVE-2026-72863: Improper Privilege Management

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy's WebSocket handlers in-app terminals and log streamers authenticate the session but never authorize it. They establish who the user is via validateRequest and then proceed without consulting the role/permissio...

CVE-2026-72864: Missing Authorization

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/docker-container-terminal.ts authenticates with validateRequest but does not authorize the attacker-controlled containerId against the caller's...

CVE-2026-72913: Improper Neutralization of Special Elements used in a Command

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

ROS-20260810-73-0031

The vulnerability of the ssh2transportread function in the libssh2 library is related to buffer overflows due to integer overflows. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using specially created SSH packets...

PT-2026-69922

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An authenticated user with application create or update permissions can execute arbitrary commands on the local build host or a remote SSH build target. This occurs because the dockerImage field is...

CVE-2026-72877: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

Linux Distros Unpatched Vulnerability : CVE-2026-68276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. ...

PT-2026-69909

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy is a self-hostable Platform as a Service PaaS. A shell injection flaw exists in the apps/dokploy/server/api/routers/destination.ts file where the destination.testConnection mutation...

PT-2026-69936

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.28.9 Description Dokploy is a free, self-hostable Platform as a Service PaaS. An authenticated user with permissions to create or update file mounts for a service can inject shell metacharacters into the filePath...

PT-2026-69981

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.48.2 Description In the kitty/window.py file, the @kitty-echo and @kitty-ssh DCS handlers write unauthenticated data to the child shell's stdin. The handle remote echo function accepts printable shell command...

MiracleLinux 9 : libxml2-2.9.13-14.el9_8.2 (AXSA:2026-1496:06)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1496:06 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly fro...

Exploit for Argument Injection in Gnu Inetutils

CVE-2026-24061 — GNU Inetutils telnetd Auth Bypass → Root Shel...

SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:3526-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3526-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598:...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock-Galaxy 中文: READMEZH.md This is...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Rejetto Http_File_Server

CVE-2024-23692 - Rejetto HFS Remote Code Execution RCE A ta...

MAL-2026-13632 Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

CVE-2026-48120

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...