CVE-2026-107056

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

CVE-2026-99123

A flaw was found in the Linux kernel's Virtual Sockets vsock virtio transport. Incoming packets for connecting sockets are not properly validated against their expected source address. A local, unprivileged attacker can exploit this vulnerability by sending crafted packets during connection setup...

EUVD-2026-113258

Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message...

CVE-2026-107056

The OpenTracks application (versioncode 6751 ) is vulnerable to unauthorized data injection due to insecure permissions in the io.file.importer.ImportActivity component. An attacker can exploit this by sending a crafted SEND message to inject malicious tracking data directly into the victim's loc...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins versions 2.587 and earlier (including LTS 2.580.1 and earlier ) are vulnerable to a flaw where an attacker with Overall/Read permission can trigger warnings within the "Manage Old Data" feature. If an administrator acts on these warnings, they may inadvertently inject attacker-controlled ...

EUVD-2026-112185

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

CVE-2026-117620

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

pfSense - Arbitrary File Write

diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...

CVE-2026-117620: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

PT-2026-128308

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords...

USN-8955-1 nginx vulnerabilities

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-15176 It was discovered tha...

AquaSense-ICS: A Hybrid Real-Simulated Cyber-Physical Dataset and Leakage-Aware Benchmark for Smart Water Quality Monitoring and Attack Detection

Machine-learning research on water cyber-physical systems CPS is constrained by datasets that are either real but chemically poor, or simulated but free of sensing noise and attacks. We present AquaSense-ICS, an open dataset and benchmark that co-registers i a 25.4 h recording window 8.0 h of...

Trigger.dev: Unauthenticated Realtime Stream Data Injection Via Run FriendlyId

Summary The POST handler for "/realtime/v1/streams/:runId/:streamId" has no authentication. Any entity that knows or guesses a run friendlyId can inject arbitrary data into its realtime stream. Vulnerability Details File: "apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts" The "actio...

BIT-NGINX-GATEWAY-2026-95101 NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

BIT-NGINX-2026-95101 NGINX ngx_http_v3_module vulnerability

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

CVE-2026-114086

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114086 Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

EUVD-2026-106889

Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers to inject data into run streams. Attackers can send POST requests to /realtime/v1/streams/:runId/:streamId with a predictable run friendlyId to injec...

CVE-2026-114086

The Trigger.dev platform (versions prior to 4.5.5 ) is vulnerable to a missing authentication flaw in the realtime streams POST handler. This allows unauthenticated attackers to inject arbitrary data into run streams by sending POST requests to the /realtime/v1/streams/:runId/:streamId endpoint u...