EUVD-2026-52508

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

securix v0.17

SécurixOS: Secure OS Workstation Base !NOTE This project is in alpha , no support is offered at this time. Objectives SécurixOS is a NixOS distribution developed by DINUM to equip secure computers for system administration, office work and development in order to handle Unprotected information...

PT-2026-67679

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67678

Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465: Insufficient Session Expiration

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67684

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67680

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Path Traversal. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67681

Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67683

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2026-2033)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2033 advisory. In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the...

CVE-2026-18684

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

CVE-2026-18684

This CVE concerns GL.iNet GL-MT3000 devices (firmware up to 4.4.5). The issue lies in the function remove_profile of the file /cgi-bin/glc within component modem.so, enabling command injection. The vulnerability can be triggered remotely, and public exploit code exists. The vendor was informed an...

CVE-2026-18684 GL.iNet GL-MT3000 modem.so glc remove_profile command injection

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

CVE-2026-67974

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

CVE-2026-66065

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...

CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

CVE-2026-18738 Shlink CSV Formula Injection via Visit Export CLI

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

CVE-2026-18632

CVE-2026-18632 affects langgenius dify up to 1.14.2, specifically the Jinja2 Handler’s jinja2_transformer.py (api/core/helper/code_executor/jinja2/jinja2_transformer.py) and its use of jinja2.Template. The vulnerability arises from improper neutralization of special elements used in the template ...

CVE-2026-18655 Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server awslabs.amazon-mq-mcp-server before 2.0.24 may allow a remote unauthenticated actor via prompt injection to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent t...