spd_flasher

CVE-2022-38694 Hardened Exploit — RP2350 USB Host Auto Flasher 中文版 README Tutorial UDX710 Boot Chain Reverse Engineering and RP2350 Hardened Boot Tutorial Exploiting CVE-2022-38694 Unisoc BootROM vulnerability via Raspberry Pi RP2350 USB Host to automatically send SPL Loader on boot and start...

PT-2026-85543

AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read...

EUVD-2026-71613

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...

Linux Distros Unpatched Vulnerability : CVE-2026-85043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic...

Linux Distros Unpatched Vulnerability : CVE-2026-80806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in...

UBUNTU-CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-85044

Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-84185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the...

PT-2026-85540

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

CVE-2026-78970

JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...

UBUNTU-CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

PT-2026-85547

Name of the Vulnerable Software and Affected Versions goose versions prior to 1.38.0 Description The software executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. This occurs because the recipe security scan skips these two fields, allowing...

RHEL 10 : buildah (RHSA-2026:63332)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63332 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

Linux Distros Unpatched Vulnerability : CVE-2026-84961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON...

CVE-2026-78970

JeecgBoot 3.9.2 and earlier is affected by an authorization bypass in the SystemApiController component. An authenticated attacker holding any valid JWT token can call endpoints such as queryAllUser , queryUsersByUsernames , queryUserById , and queryUsersByIds to retrieve real names, phone number...

PT-2026-85494

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

PT-2026-85496

Traefik versions = v3.7.0 and = v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generated for an Ingress carrying the nginx.ingress.kubernetes.io/auth-tls-secret annotation was named after the Ingress namespace and name. As a result, two Ingress...

PT-2026-86177

CVE-2026-73848: XSS in emlog ≤2.6.29 via unescaped tag names in article editor. Attacker executes arbitrary JS via crafted tag—full account takeover risk. CVSS N/A. UNPATCHED. Update or restrict editor access immediately. Details: https://t.co/utDcwWYnT1 cybersecurit valtersit CVE CVEAlert infose...

Linux Distros Unpatched Vulnerability : CVE-2026-14199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key...

CVE-2026-85043

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. Chromium security severity: High...