CVE-2018-25189

creationtimestamp| type| source ---|---|--- 2026-03-06 13:54:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgfhlde5ii2e...

CVE-2025-38154

creationtimestamp| type| source ---|---|--- 2026-03-06 13:10:10+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mgff4w63em24 2026-03-27 15:15:16+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mi2fvy5bw326 2026-03-31 20:00:00+00:00| seen|...

CVE-2026-29049 melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout pkg/renovate/cache/cache.go. An attacker-controlled URI in a melange config can cau...

CVE-2026-28481

creationtimestamp| type| source ---|---|--- 2026-03-06 02:28:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgebc6knig2y...

Exploit for CVE-2024-3912

Why? Publishing because Mirai are a bunch of irrit...

CVE-2026-3613 Wavlink WL-NU516U1 login.cgi sub_401A0C stack-based overflow

A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub401A0C of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-3613

A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub401A0C of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : openvpn (SUSE-SU-2026:0831-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0831-1 advisory. - Updated to version 2.6.10 that fixes: CVE-2025-13086: improper validation of IP addresses that can caus...

Busting VPN myths: What a VPN can do for your privacy and what it can’t

Privacy Busting VPN myths: What a VPN can do for your privacy and what it can’t Share March 6th, 2026 If you’re reading this blog, you have probably heard of or used a VPN before. The truth is, VPNs are incredibly useful! They are one of the most effective tools for protecting your online privacy...

TencentOS Server 4: libpcap (TSSA-2026:0123)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0123 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

OpenSift code-related vulnerabilities

OpenSift is an open-source artificial intelligence learning assistant developed by OpenSift. Versions of OpenSift prior to 1.6.3-alpha contained code vulnerabilities. These vulnerabilities stemmed from the URL ingestion pipeline accepting remotely controlled URLs under user control, resulting in...

Node.js Adapter for Hono security vulnerability

The Node.js Adapter for Hono is an open-source tool developed by Hono, designed to run Hono applications on Node.js. Versions of the Node.js Adapter for Hono prior to 1.19.10 contained a security vulnerability. This vulnerability stemmed from inconsistent URL decoding, which could allow access to...

Plane code issue vulnerabilities

Plane is an open-source, self-hosted project planning tool developed by Plane OpenSource. Versions of Plane prior to 1.2.3 contained code vulnerabilities. These vulnerabilities stemmed from the Webhook URL validation only checking ip.isloopback, which could allow attackers with the ADMIN role to...

CVE-2026-27137: Improper Certificate Validation

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered...

Medium: evolution-data-server

Issue Overview: The Evolution backend server exposes the D-Bus service org.gnome.evolution.dataserver.AddressBook, that can be used in order to manage contacts. A Flatpak application with access to this D-Bus service can exploit this issue in order to gain arbitrary file deletion on the host...

Evaluating Generalization Mechanisms in Autonomous Cyber Attack Agents

Autonomous offensive agents often fail to transfer beyond the networks on which they are trained. We isolate a minimal but fundamental shift -- unseen host/subnet IP reassignment in an otherwise fixed enterprise scenario -- and evaluate attacker generalization in the NetSecGame environment. Agent...

Golang 1.25.x < 1.25.8 / 1.26.x < 1.26.1 Multiple Vulnerabilities

The version of Golang running on the remote host is prior to 1.25.8, or 1.26.x prior to 1.26.1. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted...

PT-2026-23625

Name of the Vulnerable Software and Affected Versions Wavlink WL-NU516U1 version V240425 Description A stack-based buffer overflow exists in the function sub 401A0C within the file /cgi-bin/login.cgi. Manipulation of the ipaddr argument can trigger this issue, allowing for remote exploitation. Th...

CVE-2026-29613 OpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust

OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles optional plugin webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured webhook passwords. When the gateway operat...

CVE-2026-29613

OpenClaw is affected in versions prior to 2026.2.12, where the BlueBubbles optional plugin webhook handler authenticates requests only by loopback remoteAddress and does not validate forwarding headers. This allows an unauthenticated attacker, especially when behind a reverse proxy, to reach the ...