Linux Distros Unpatched Vulnerability : CVE-2026-88383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libical 4.0.6 contains an incompatible function pointer in icalparameterstringtokind. When parsing iCalendar data containing a parameterized property, the...

EUVD-2026-86316

libical 4.0.6 contains an incompatible function pointer in icalparameterstringtokind. When parsing iCalendar data containing a parameterized property, the function passes icalparametercomparekindmap to bsearch through an incompatible comparator function pointer type. bsearch invokes the callback...

UBUNTU-CVE-2026-93815

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move freeirq out of the close-time spinlocked section au1000close calls freeirq while aup-lock is still held with spinlockirqsave. freeirq can sleep because it takes the IRQ descriptor request mutex, so it does not...

CVE-2025-12758

CVE-2025-12758: Validator.js isLength Unicode Variation Selector バイパス CVE ID: CVE-2025-12758 CVSS スコア: 8.7 HIGH 重要度: HIGH CWE: CWE-792 Incomplete Filtering of One or More Instances of Special Elements 公開日: November 26, 2025 開示日: October 19, 2025 脆弱性の概要 この脆弱性は、validator npm パッケージのバージョン 13.15.22...

CVE-2026-77413

A flaw was found in JSONata. The lookup function, a component of the JSONata query and transformation language, did not properly validate object properties. This oversight allowed an attacker to craft malicious expressions that could access and manipulate sensitive inherited prototype members...

CVE-2026-82406

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

CVE-2026-82406 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

CVE-2026-82406 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

RLSA-2026:69541 Important: rsyslog security update

The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fixes: rsyslog: rsyslog: Denial of service via heap buffer overflow in...

EUVD-2026-85368

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

CVE-2026-96654

Plex Media Server versions prior to 1.43.3.10861 are vulnerable to a URL injection flaw. The software fails to correctly neutralize URL values within the 'searchOne' parameter, which enables an attacker to call functions from other plugins and provide their own parameters. While the documents do ...

CVE-2026-73588

Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is susceptible to a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access can exploit this flaw to gain unauthorized access . Remediation is available via the sec...

CVE-2026-92378

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be...

CVE-2025-55182

CVE-2025-55182 - React Server Components RCE NOTE: Written by AI/Claude https://github.com/ejpir/CVE-2025-55182-bypass TL;DR CVE-2025-55182 は、React の Flight Protocol における重大な RCE 脆弱性です。この攻撃は パストラバーサル + 偽のチャンク注入 + $B ハンドラの悪用 を連鎖させ、Functionattackercode を実行します。 ワーキングエクスプロイトチェーンを提供してくれたmaple3142...

CVE-2025-65018_Exploit_Challenge

CVE-2025-65018 CTFチャレンジ: "PNG Panic" このチャレンジは、libpng の実世界のバッファオーバーフロー脆弱性に基づいています（具体的には、16ビットのインターレース画像を処理する際の簡易API pngimagefinishread に関するものです）。 🚩 チャレンジの目標 提供される脆弱なバイナリ victim は、静的にリンクされた脆弱なバージョンの libpng を使用しています。このアプリケーションは、exploit.png という名前のPNGファイルをバッファに読み込みます。...

EUVD-2026-85153

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be...

CVE-2026-92378

A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online . Under specific timing conditions during Service Offline Emergency Mode , a previously authenticated session may be retained after a user logs out. This flaw could allow a subseque...

CVE-2026-5924

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.3 . The flaw exists within the Google Maps block due to the customStyle attribute, where the mapStyles() function in the frontend JavaScript uses eval() on...

CVE-2024-37770

CVE-2024-37770 説明 14Finger v1.1 は、fingerprint機能にリモートコマンド実行（RCE）の脆弱性が含まれていることが発見されました。この脆弱性により、攻撃者は細工されたペイロードを介して任意のコマンドを実行できます。 攻撃ベクトル 認証されていない攻撃者は、シェルメタキャラクタを介してコマンドインジェクションを実行し、リモートサーバーでRCEを引き起こす可能性があります。 詳細 コア機能のフィンガープリントスキャンポイントに、認証されていないリモートコマンド実行の脆弱性があります。...

EUVD-2026-84941

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor...