CVE-2026-77004

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...

EUVD-2026-63480

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-77004 Comfast CF-N1-S mbox-config sprintf command injection

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...

EUVD-2026-63479

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptestsn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may b...

CVE-2026-77084

n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1 ) is affected by a code execution vulnerability in the Git node . The node executed certain repository-local git configuration values without neutralizing them, allowing arbitrary command execution as the n8n process user when a subsequent Git n...

OESA-2026-3439 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives...

OESA-2026-3405 kata-containers security update

This is core component of Kata Container, to make it work, you need a isulad/docker engine. Security Fixes: Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to version 4.0.0, kata-runtime is...

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...

PT-2026-79069

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub 44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The...

Oracle Linux 9 : ansible-core (ELSA-2026-57149)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57149 advisory. 1:2.14.18-3.1 - Fix CVE-2026-11332 prevent arbitrary git configuration via role requirements RHEL-194134 Tenable has extracted the preceding description block...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the spring.cloud.config.server.svn.basedir...

PT-2026-79055

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may ...

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...

Linux Distros Unpatched Vulnerability : CVE-2026-76221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directiv...

Oracle Linux 10 : ansible-core (ELSA-2026-57148)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-57148 advisory. 2.16.16-2.0.1.el102.1 - exclude telemetry from Oracle Linux 1:2.16.16-2.1 - Fix CVE-2026-11332 ansible-galaxy role installs could allow arbitrary git...

PT-2026-78939

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.x prior to 2.34.1 Description A code execution issue exists in the Git node. The node executes specific repository-local git configuration values without proper...

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the process that handles incoming payloads. An attacker can cause service disruption by sending specially crafted malicious payloads. Remediation Upgrade...

Directory Traversal

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Directory Traversal via the native environment repository process. An attacker can access sensitive...