PT-2026-103525

Name of the Vulnerable Software and Affected Versions Itron MV-90 xi version 3.0 Description Passwords and password histories are stored improperly in the configuration file, allowing attackers to decode them and gain unauthorized access to the MV-90 application as any user. Recommendations At th...

AlmaLinux 9.2 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1762361016)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762361016 advisory. - A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible fo...

CentOS Linux 8 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1786012443)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1786012443 advisory. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove...

Rocky Linux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786471937)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786471937 advisory. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove...

AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786471937)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786471937 advisory. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove...

AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779467653)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779467653 advisory. - There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-102269 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-102269 Source advisory: OSV:GHSA-HXM8-2XGR-2P9M...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-102268 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-102268 Source advisory: OSV:GHSA-FFC3-869F-JXW9...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-102267 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-102267 Source advisory: OSV:GHSA-9V7F-9G4P-FFGJ...

django-avishan (0.2.0), pilot-config (>=2.5.1, <=2.5.10) +2 more potentially affected by CVE-2026-101917 via pyjwt (1.7.0)

pyjwt PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-avishan 0.2.0 - pilot-config =2.5.1, =2.4.0, =2.4.1 Source cves: CVE-2026-101917 Source advisory: OSV:GHSA-2GX3-RCP4-G85Q...

Exploit for PHP Remote File Inclusion in Wordpress

⚡ XWPRCE — CVE-2026-87902 Hacker Console WordPress Core g...

CVE-2026-79535

mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...

MAL-2026-17274 Malicious code in @hrmony/pladddform-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de81847796671c2a5e9f97a94fae50352b0dff0816e4f0a7dfaf707fbb92629 index.js executes at module top level on require/import. It performs an unconditional POST check-in to...

Malicious code in @hrmony/pladddform-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de81847796671c2a5e9f97a94fae50352b0dff0816e4f0a7dfaf707fbb92629 index.js executes at module top level on require/import. It performs an unconditional POST check-in to...

Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

CVE-2026-41875

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

EUVD-2026-88741

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...