OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise...

cam-hunter

📡 CAM HUNTER — Advanced DVR / NVR / XVR Security Testing Frame...

CVE-2026-68577

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-68576

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-68575

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

CVE-2026-68574

Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked...

[SECURITY] Fedora 43 Update: pack-0.40.8-1.fc43

pack is a CLI implementation of the Platform Interface Specification for Cloud Native Buildpacks...

PT-2026-66872

Name of the Vulnerable Software and Affected Versions gemini-bridge versions 1.0.0 through 1.3.0 Description The consult gemini with files function in inline mode allows an arbitrary local file read. When the mode is set to "inline", the server reads any file path provided in the files argument...

Dulwich Git Command Injection

The vulnerability of the Python library for working with Git repositories in Dulwich is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Security update for python-nltk (important)

openSUSE Security Update: Security update for python-nltk Announcement ID: openSUSE-SU-2026:0269-1 Rating: important References: 1272667 Cross-References: CVE-2025-71408 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)

Last week, there were 264 vulnerabilities disclosed in 210 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 117 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

cmdchamp v1.2.15

cmdchamp Bash CLI trainer — 30 levels from ls to privilege escalation. Every question asks you to type a real command — get instant feedback, move on. Many run against real files in the sandbox, and all accept multiple valid syntaxes sort -u or sort | uniq. Tab toggles the manpage when you need a...

JLSEC-2026-1083 ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line...

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...

JLSEC-2026-1051

ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed connected-components definitions via CLI, causing denial of...

CVE-2026-41186

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

EUVD-2026-51155

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled disabled by default, the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks including...

CVE-2026-41186

The CVE-2026-41186 issue affects Calico components (shared debug server used by kube-controllers and Goldmane). When enabled, the Go pprof debug listener binds to 0.0.0.0 and lacks authentication, allowing any pod with network reachability to access internal memory state via the heap, goroutine s...

CLEANSTART-2026-JW02028 Security fixes in az 2.84.0-r2

Package az version 2.84.0-r2 fixes 4 vulnerabilities: CVE-2026-44432, CVE-2026-44431, CVE-2026-39892, CVE-2026-45409...

PT-2026-76123

ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources...