CVE-2026-51718

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51718

Incorrect access control in the delStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove static DHCP reservations via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83892

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the delStaticDhcpRules function allows unauthenticated attackers to remove static DHCP reservations. This is achieved by sending a crafted POST request to the...

Malicious Package

Overview search-reservation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in search-reservation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76642f0709b362fd800a9842b53bdb8f26413b9acf26562c4a5737c7bae3e856 package.json declares a dependency whose key equals the package's own name search-reservation and whose value is the bare URL...

MAL-2026-15521 Malicious code in search-reservation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76642f0709b362fd800a9842b53bdb8f26413b9acf26562c4a5737c7bae3e856 package.json declares a dependency whose key equals the package's own name search-reservation and whose value is the bare URL...

CVE-2026-80691

CVE-2026-80691 is a NULL pointer dereference in the Linux kernel SCSI target iblock subsystem . In iblock_execute_pr_out(), the PRO_PREEMPT , PRO_PREEMPT_AND_ABORT , and PRO_RELEASE operations perform capability checks through ops->pr_clear; the flawed check allows unimplemented hooks to pass,...

SUSE CVE-2026-74319

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix deadlock waiting for ticket during data relocation When performing data relocation on a zoned filesystem, BTRFS can deadlock in handlereservetickets. The relocation process is waiting on a space reservation tick...

CVE-2026-81706

creationtimestamp| type| source ---|---|--- 2026-08-27 18:09:58+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mu3gza2b7k2t 2026-08-27 19:24:01+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117169103851890443 2026-08-28 10:20:06+00:00| seen|...

Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests

Aikido Security has published research that recreates the Australian gym-booking incident in a synthetic environment, finding that Claude Opus 4.6, running on the OpenClaw agent harness, exploited a client-side-only booking restriction in 9 of 10 runs. The original incident was first reported by...

CVE-2026-14550

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...

CVE-2026-14550 WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...

CVE-2026-14550

The WPCafe WordPress plugin, in versions prior to 3.0.18 , is vulnerable to an unauthenticated reservation approval bypass . The issue stems from a missing authorization check within the plugin's REST API during reservation creation. The API verifies only a publicly available nonce , which allows...

WordPress WPCafe plugin < 3.0.18 - Unauthenticated Reservation Approval Bypass vulnerability

Unauthenticated Reservation Approval Bypass vulnerability discovered by ABIODUN VICTOR TAIWO in WordPress Plugin WPCafe versions 3.0.18...

EUVD-2026-66270

The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an arbitrary approval status and bypass the administrator...

CVE-2026-77384

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

EUVD-2026-65154

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...

CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send...