CVE-2026-75021

fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and...

CVE-2026-62652

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engine...

CVE-2026-62652

Reyrolle 7SR5 (all versions below V2.70 ) ships firmware binaries with debugging symbols that were not stripped before distribution. Because the firmware update files are publicly available , an unauthenticated remote attacker can leverage the symbols to more easily reverse-engineer the firmware ...

CVE-2026-62652

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engine...

The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the debugging console for the WatchMan-Site7 plugin of the WordPress content management system is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EUVD-2026-70039

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server...

ps5-uart — Updated!

24 pin header near salina EDM-010 root@kitploit: emc header 1 5v 2 5v 3 gnd 4 gnd 5 emc gpio a1. pulling low at emc boot causes emc rom to enter uart shell @ 460800 6 uart rx emc 115200 7 uart tx emc 115200 8 3v3, goes low when emc resets 9 0v? 10 gnd 11 titania uart0 tx efc fw: 460800, eap fw:...

CVE-2026-19401

Any remote client can crash a debugging/non-release build type NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options 17 when UDP payload size is 512. By continuously crashing the serve childs, the remote client can severely hamper or, when...

EUVD-2026-45030

Whistle vulnerable to path traversal...

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have shed light on an updated version of ToxicPanda aka TgToxic that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features...

CVE-2026-49426

This FreeBSD kernel vulnerability affects the audit(4) facility when auditing system calls executed via ptrace(PT_SC_REMOTE) . The root cause is that the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() instead of the actual system call result, causing failed o...

CVE-2026-72037

A flaw was found in the Linux kernel's lan743x Ethernet driver. A system lock, or spinlock, is accessed during the driver's initialization sequence before it has been properly set up. This improper initialization can lead to a system crash if kernel debugging features are enabled, resulting in a...

CVE-2026-72375

CVE-2026-72375 affects the Linux kernel and relates to the AFS subsystem. The issue arises from insufficient reinitialisation of afs_vnode::lock_work (and related lock_work handling) during inode allocation, causing intermittent warnings from debugobjects (e.g., “activate not available” messages ...

CVE-2026-66403

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

EUVD-2026-55110

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock-Galaxy 中文: READMEZH.md This is...

Malicious code in golaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...

CLSA-2026-1777077479 TuxCare security update for debug (1 CVE)

TuxCare rebuilt debug to address 1 CVE. Fixed in 3.1.0-tuxcare.2...

Multiple vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App

Overview Robotic cleaners DEEBOT PRO M1 and DEEBOT PRO K1VAC, and mobile app ECOVACS PRO App developed by ECOVACS ROBOTICS contain multiple vulnerabilities. They are provided in Japan by Hellohas Robotics Inc. web server for debugging purposes remains enabled CWE-489 - CVE-2026-66403 Missing serv...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the readBlock method of PGPAeadInputStream BcAEADUtil, mirrored in JceAEADUtil, which pre-reads the final 16 bytes but ignores the result and returns EOF without calling doFinal when the...