EUVD-2026-65531

Winter CMS before 1.2.13 contains a local file inclusion vulnerability in the JavascriptImporter filter that allows authenticated users with cms.manageassets permission to disclose arbitrary server-readable files by placing =include or =require directives in theme JavaScript assets. Attackers can...

IPI-exposure-signal

IPI Exposure Signal Questo è il repository del codice per il nostro articolo: Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure. Versione arXiv e link all'articolo: https://arxiv.org/abs/2608.02657 Questo repository implementa la pipeline di probing per i...

ROOT-OS-DEBIAN-12-CVE-2025-37768 CVE-2025-37768 in linux - Patched by Root

Root has patched CVE-2025-37768 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-21634 CVE-2025-21634 in linux - Patched by Root

Root has patched CVE-2025-21634 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-38729 CVE-2025-38729 in linux - Patched by Root

Root has patched CVE-2025-38729 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-43308 CVE-2026-43308 in linux - Patched by Root

Root has patched CVE-2026-43308 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-53185 CVE-2026-53185 in linux - Patched by Root

Root has patched CVE-2026-53185 in the linux package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-55525

PraisonAI (praisonaiagents), a multi-agent teams system, is vulnerable to SSRF via redirect-following in the web_crawl function prior to version 1.6.58 . The root cause is that only the initial URL's resolved IP is validated against a private/loopback blocklist, while the underlying httpx.Client(...

curl: ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

cleanarg operates on char str, which is the UTF-8 copy allocated by converttchartoUTF8. It has no reference to the original wchart argv element. c / toolgetparam.c:632 / static void cleanargchar str / now that getstr has copied the contents of nextarg, wipe the next argument out so that the...

BIT-KEYCLOAK-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

CVE-2026-79660

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

CVE-2026-79669

Ech0 versions before 4.4.3 lack authorization checks on system log endpoints, allowing any authenticated non-admin user to read and stream all server logs. The vulnerable endpoints are GET /api/system/logs , GET /api/system/logs/stream , and WS /ws/system/logs . An attacker can gather reconnaissa...

CVE-2026-79666 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

EUVD-2026-65454

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

CVE-2026-79660

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model . Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without any auth...

CVE-2026-55976

Server-Side Request Forgery SSRF in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is...

CVE-2026-21754

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications...

cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure

CVE-2026-34474: ZTE H298A / H108N में ETHCheat के माध्यम से गोपनीय जानकारी लीक CVE-2026-34474 का तकनीकी विवरण, जहाँ एक बिना प्रमाणीकरण वाला ETHCheat=1 अनुरोध प्रभावित ZTE ZXHN H298A 1.1 और H108N 2.6 राउटरों को प्रतिक्रिया मार्कअप में लाइव व्यवस्थापक पासवर्ड, ESSID और WLAN PSK लौटाने के लिए विवश...

CVE-2026-21754

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities that could enable unauthorized lateral movement , container breakout , and sensitive data exposure within internal communications. The CVSS 3.1 base score is 5.4 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R...

CVE-2026-21754 HCL Hive is affected by multiple security vulnerabilities.

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications...