CVE-2026-2776

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-2776

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

CVE-2026-1772

CVE-2026-1772 concerns the RTU500 web interface, where an unprivileged user can read user management information. The vulnerability does not require UI access and can be exploited via browser developer tools, with no user interaction and network-based access. The CVSS 4.0 vector indicates: AV:N/A...

CVE-2026-1772

RTU500 web interface: An unprivileged user can read user management information. The information cannot be accessed via the RTU500 web user interface but requires further tools like browser development utilities to access them without required privileges...

CVE-2026-22553

creationtimestamp| type| source ---|---|--- 2026-02-24 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-01 2026-02-24 21:28:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfn4dndg7f2s 2026-02-24 21:30:34+00:00| seen|...

CVE-2026-27127

creationtimestamp| type| source ---|---|--- 2026-02-24 05:42:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mflhh4ikiv2n 2026-02-24 07:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116124433256203308 2026-02-24 07:30:35+00:00| seen|...

VulnCheck KEV: CVE-2026-20931

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network...

PT-2026-21760

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.75.0 Description Payload is a free and open source headless content management system. A Server-Side Request Forgery SSRF issue exists in the external file upload functionality. Insufficient validation of HTTP...

Payload CMS 代码问题漏洞

Payload CMS is an open-source content management system developed by Payload. Versions of Payload CMS prior to 3.75.0 contained code vulnerabilities. These vulnerabilities stemmed from insufficient validation of HTTP redirection during the external file upload function, which could lead to...

Linksys MR9600和Linksys MX4200 安全漏洞

The Linksys MR9600 and Linksys MX4200 are both products of the American company Linksys. The Linksys MR9600 is a wireless router. The Linksys MX4200 is a mesh network router. Both the Linksys MR9600 version 1.0.4.205530 and the Linksys MX4200 version 1.0.13.210200 have security vulnerabilities...

CVE-2026-23521 Traccar vulnerable to Path Traversal and External Control of File Name or Path

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticated users who can create or edit devices can set a device uniqueId to an absolute path. When uploading a device image, Traccar uses that uniqueId to build the filesystem path...

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. "Analysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated,...

CVE-2026-27729

creationtimestamp| type| source ---|---|--- 2026-02-23 13:07:42+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-jm64-8m5q-4qh8 2026-02-26 04:40:19+00:00| seen| https://gist.github.com/alon710/c4c795d4b3dc7802a6d056ea6b479de3...

CVE-2026-2913

A vulnerability was determined in libvips up to 8.19.0. The affected element is the function vipssourcereadtomemory of the file libvips/iofuncs/source.c. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The attack's complexity is rated as...

CVE-2025-60183

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Stored XSS.This issue affects Silencesoft RSS Reader: from n/a through = 0.6...

XML External Entity (XXE)

fast-xml-parser is vulnerable to XML External Entity XXE. The vulnerability is due to improper restriction of entity expansion in the XML parser, which allows an attacker to supply a crafted XML with excessive entity definitions causing resource exhaustion and denial of service by forcing the...

XML External Entity (XXE)

org.assertj, assertj-core is vulnerable to XML External Entity XXE. The vulnerability is due to the DocumentBuilderFactory in org.assertj.core.util.xml.XmlStringPrettyFormatter.toXmlDocumentString being initialized with default settings without disabling DTDs or external entities, which allows an...

CVE-2025-8055

Server-Side Request Forgery SSRF vulnerability in OpenText™ XM Fax allows Server Side Request Forgery. The vulnerability could allow an attacker to perform blind SSRF to other systems accessible from the XM Fax server. This issue affects XM Fax: 24.2...

Malicious code in naniod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 770f12de16c059d53c80a9f7e99035fcf1f454cefcedcf6ad4e7893e8a775726 The package naniod was found to contain malicious code. Source: ghsa-malware 5956bf743e4cd707100421a35c80a88d7dfd99a213b2c584c50b27bcf12e0952 Any...