PT-2026-46390

Name of the Vulnerable Software and Affected Versions IRIS versions prior to 2.4.28 Description IRIS is a web collaborative platform designed for incident responders to share technical details during investigations. The software is susceptible to a cross-site request forgery attack, which occurs...

JetBrains TeamCity < 2025.11.2 Sensitive Data Exposure (CVE-2026-49377)

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters CVE-2026-49377 Note that Nessus has not tested for this issue but h...

Iris security vulnerabilities

Iris is a fast, simple, yet fully functional and highly efficient Go network framework developed under the DFIR-IRIS open source project. Versions of Iris prior to 2.4.28 contained security vulnerabilities, which were caused by the return of unnecessary sensitive data...

GHSA-F22V-GFQF-P8F3 React Router has stored XSS via unescaped Location header in prerendered redirect HTML

When using React Router v7 Framework Mode with Pre-rendering enabled, an improper neutralization of the HTTP Location header value can permit Cross-Site Scripting XSS in statically generated HTML files if the redirect location comes from an untrusted source. !NOTE This does not impact your React...

EUVD-2026-33986

React Router has stored XSS via unescaped Location header in prerendered redirect HTML...

CVE-2026-40495 FOSSBilling version exposed via asset cache buster

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 leak the exact system version through asset cache buster parameters in HTML output, bypassing the hideversionpublic security setting. The FOSSBilling version is embedded in the query string of every a...

CVE-2026-40495 FOSSBilling version exposed via asset cache buster

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 leak the exact system version through asset cache buster parameters in HTML output, bypassing the hideversionpublic security setting. The FOSSBilling version is embedded in the query string of every a...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.0 release.

Red Hat Web Terminal Operator 1.15.0 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.0 release.

Red Hat Web Terminal Operator 1.14.0 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

CVE-2026-36616

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware binary...

Exploit for Stack-based Buffer Overflow in Microsoft

LongLogon · CVE-2026-41089 !CVE-2026-41089 · NVDhttps://i...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2026-8404 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2026-8404 Source advisory:...

GHSA-XH68-HFP5-5X5M daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 as header line separators, but autobahn decodes header values to str and calls splitlines. An...

django-codenerix (1.0.0), django-pre-post (1.0.0) +2 more potentially affected by CVE-2026-48587 via django (1.10.6)

django PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-codenerix 1.0.0 - django-pre-post 1.0.0 - teamvault =0.7.0, =0.2.5, =0.3.0.dev14 Source cves: CVE-2026-48587 Source advisory:...

CVE-2026-42317 GLPI vulnerable to arbitrary files deletion by technician

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgrade to 10.0.25 or 11.0.7 to receive a patch...

EUVD-2022-55999

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Versions prior to 5.0.13, 4.1.69, and 4.0.63 are vulnerable to cross-site scripting. An attacker could conduct a targeted phishing...

CVE-2026-48587

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.utils.cache.hasvaryheader in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

CVE-2025-32433 분석 포트폴리오 Erlang/OTP SSH 사전인증 원격 코드 실행 취약점 분석...

AZL-89328 CVE-2026-50031 affecting package freeipmi for versions less than 1.6.18-1

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface IPMI specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system managemen...

SUSE CVE-2026-33244

React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with pre-rendering enabled, improper neutralization of the HTTP Location header value can permit Cross-Site Scripting XSS in the statically generated HTML files if the redirect location comes from an...