CVE-2025-63579: Exposure of Sensitive Information to an Unauthorized Actor

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and other sensitive information can be...

CVE-2025-63579

Kyocera Command Center RX printers are vulnerable to an unauthorized access flaw that allows an attacker to export all information stored in the Kyocera address book . This vulnerability enables the bypass of security measures intended to encrypt incoming data, allowing for the decryption of sens...

CVE-2025-63579

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and other sensitive information can be...

MAL-2026-10032 Malicious code in @wagni_bot/polygon-sdk (npm)

The npm package @wagnibot/polygon-sdk is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

CVE-2025-63579

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and other sensitive information can be...

CVE-2026-31267

The Mercusys MW302R (specifically MW302R(EU)_V1_1.4.10 Build 231023 ) is vulnerable to a stack buffer overflow in its administrative web interface. An authenticated attacker with administrative privileges can trigger a system crash by sending a specially crafted request. This vulnerability allows...

CVE-2026-51598

An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line...

CVE-2026-51598

An input validation vulnerability in the RTSP service of MERCURY MIPC252W IP Camera v1.0.5 Build 230306 Rel.79931n allows an unauthenticated, network-adjacent attacker to cause a denial of service via a crafted DESCRIBE request with a malformed URL in the request line...

SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:2801-1)

"The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2801-1 advisory. This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats- binary...

MAL-2026-10034 Malicious code in @wagni_bot/pumpfun-sdk (npm)

The npm package @wagnibot/pumpfun-sdk is a supply-chain credential stealer disguised as a Pump.fun SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

CVE-2026-60105

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...

CVE-2026-60105

Monsta FTP versions prior to 2.14.5 are vulnerable to a server-side request forgery (SSRF) in the fetchRemoteFile action. The root cause is an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect IPv4 addresses embedded within IPv4-mapped IPv6 addresses. An unauthent...

DEBIAN-CVE-2026-59947

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-0288

CVE-2026-0288 describes multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS. An unauthenticated attacker with network access can trigger DoS or potentially execute arbitrary code by sending specially crafted traffic. PAN-OS Pa...

MAL-2026-7019 Malicious code in npm-rce-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6365312ad1339c7d5539f594b9e472ea3f10401fa356fe49766de887368e87c9 Package declares a postinstall lifecycle script that, on npm install, fetches a script over plain HTTP from a hardcoded bare IP...

SUSE-SU-2026:2801-1 Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues - CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary...

stack-buffer-overflow-exploit

Stack Buffer Overflow — Shellcode Injection Educational Proje...

Server-side Request Forgery (SSRF)

Overview repomix is an A tool to pack repository contents to single file for AI consumption Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the processRemoteRepo path in POST /api/pack and its repository URL handling before git clone. An attacker can...

DEBIAN-CVE-2026-59883

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain applied ordinary suffix matching to domains such as 192.168.0.1, ::1, or 1, allowing...

Malicious code in ec-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc8245936c8beb04bdb2bfe31a8117133823e3ffd6ed3e165d89b822dfab4a9c package.json declares a preinstall script that runs npm install @sentry/node && node examples/verify.js. examples/verify.js initializes the package's...