1072 matches found
CVE-2026-27177: Improper Neutralization of Input During Web Page Generation
MajorDoMo aka Major Domestic Module contains a stored cross-site scripting XSS vulnerability via the /objects/?op=set endpoint, which is intentionally unauthenticated for IoT device integration. User-supplied property values are stored raw in the database without sanitization. When an administrat...
📄 MongoDB BSON Decompression OP_COMPRESSED Memory Disclosure
This Metasploit module demonstrates an educational memory leak in MongoDB BSON decompression. It sends malformed BSON in OPCOMPRESSED messages to trigger memory disclosure. Quite a huge list of versions are affected...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-driver-nfs, apache-exporter, delve, cilium-cli, http-echo, mongodb-kubernetes-operator, cortex, terraform-provider-grafana, terraform-provider-azuread, velero, kyverno-policy-reporter, splunk-otel-collector, gofumpt, render-template, crane,...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-driver-nfs, apache-exporter, delve, cilium-cli, http-echo, mongodb-kubernetes-operator, cortex, terraform-provider-grafana, terraform-provider-azuread, kyverno-policy-reporter, splunk-otel-collector, crane, addon-resizer, aactl,...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: kubernetes-csi-driver-nfs, apache-exporter, delve, cilium-cli, http-echo, mongodb-kubernetes-operator, cortex, terraform-provider-grafana, terraform-provider-azuread, velero, kyverno-policy-reporter, splunk-otel-collector, gofumpt, render-template, crane,...
CVE-2025-68121 vulnerabilities
Vulnerabilities for packages: speedtest-go, crossplane-provider-aws-kms, crossplane-provider-aws-cloudfront-fips, json-exporter, terraform-provider-azapi-fips, git-sync-fips, cluster-autoscaler, gitlab-rails-ce, pguser, pgpool2exporter-fips, vertical-pod-autoscaler, dapr, amazon-eks-ami, loki,...
CVE-2025-61732 vulnerabilities
Vulnerabilities for packages: speedtest-go, crossplane-provider-aws-kms, crossplane-provider-aws-cloudfront-fips, json-exporter, terraform-provider-azapi-fips, git-sync-fips, yq, cluster-autoscaler, gitlab-rails-ce, pguser, pgpool2exporter-fips, vertical-pod-autoscaler, dapr, amazon-eks-ami, loki...
GHSA-8JVR-VH7G-F8GX vulnerabilities
Vulnerabilities for packages: speedtest-go, crossplane-provider-aws-kms, crossplane-provider-aws-cloudfront-fips, json-exporter, terraform-provider-azapi-fips, git-sync-fips, yq, cluster-autoscaler, gitlab-rails-ce, pguser, pgpool2exporter-fips, vertical-pod-autoscaler, dapr, amazon-eks-ami, loki...
CVE-2026-23109 fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
In the Linux kernel, the following vulnerability has been resolved: fs/writeback: skip ASNODATAINTEGRITY mappings in waitsbinodes Above the while loop in waitsbinodes, we document that we must wait for all pages under writeback for data integrity. Consequently, if a mapping, like fuse,...
Op Neusploit: Russian APT28 Uses Microsoft Office Flaw in Malware Attacks
A new campaign by the Russian-linked group APT28, called Op Neusploit, exploits a Microsoft Office flaw to steal emails for remote control of devices in Ukraine, Slovakia, and Romania...
CVE-2026-24775: Insufficient Verification of Data Authenticity
OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, OpenProject maintainers added a custom extension in OpenProject version 17.0.0 that allows to mention OpenProject work packages in the document. To show work...
CVE-2021-47851: Improper Neutralization of Special Elements used in an OS Command
Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. Attackers can leverage the /op=command endpoint to download and execute payloads by sending crafted JSON requests with malicious script...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001672)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001672 advisory. A time-of-check to time-of-use issue exists in iouring subsystem's IORINGOPCLOSE operation in the Linux kernel's versions 5.6 - 5.11 inclusive, which allows a local...
CVE-2020-23588
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028 allows an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to "Enable or Disable Ports" and to "Change port number" through " /rmtacc.asp "...
CVE-2026-21688 iccDEV has Type Confusion in SIccCalcOp::ArgsPushed() at IccProfLib/IccMpeCalc.cpp
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in SIccCalcOp::ArgsPushed at IccProfLib/IccMpeCalc.cpp. This...
CVE-2025-58436 affecting package cups for versions less than 2.3.3op2-11
CVE-2025-58436 affecting package cups for versions less than 2.3.3op2-11. A patched version of the package is available...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000410)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000410 advisory. A flaw was found in Linux Kernel because access to the global variable fgconsole is not properly synchronized leading to a use after free in confontop. Tenable has...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the opSetSloti32 function of m3exec.h. An attacker can cause memory corruption by manipulating the execution flow locally. Remediation There is no fixed version for pywasm3. References - GitHub Issue - GitHub Issu...
