PT-2026-1875

Name of the Vulnerable Software and Affected Versions TIM BPM Suite & TIM FLOW versions prior to 9.1.2 Description The application stores password hashes in MD5 format, which allows a remote attacker to escalate privileges. Recommendations Update to version 9.1.2 or later...

CVE-2025-67278

An issue in TIM Solution GmbH TIM BPM Suite & TIM FLOW before version v.9.1.2 allows a remote attacker to escalate privileges by sending a crafted HTTP request . This vulnerability is classified as an incorrect privilege assignment (CWE-266). To mitigate this risk, it is recommended to update to ...

Fedora 44 : cef (2026-94d266def6)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-94d266def6 advisory. Automatic update for cef-143.0.13^chromium143.0.7499.192-1.fc44. Changelog Fri Jan 9 2026 Than Ngo - 143.0.13^chromium143.0.7499.192-1 - Update to...

ado-vllm-performance (>=1.2.2, <=1.3.3), caption-flow (>=0.1.0, <=0.4.2) +15 more potentially affected by CVE-2026-56340 via vllm (>=0.10.2, <=0.12.0)

vllm PYPI version =0.10.2, =1.2.2, =0.1.0, =1.0.1rc1, =0.0.4, =1.0.0.dev0, =0.1.0, =0.1.1, =0.2.0, =0.0.0, =0.1.0.0, =0.1.0, =0.1.0, =0.8.0 and more Source cves: CVE-2026-56340 Source advisory: OSV:GHSA-MCMC-2M55-J8JJ...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), actinia-core (4.2.0) +696 more potentially affected by CVE-2026-21860 via werkzeug (1.0.1)

werkzeug PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.4.7, =0.1.0rc3, =2022.9.19, =1.0.2, =0.1.1, =0.1.6, =0.5.1, =0.2.0, =1.0.0, =0.0.3, =0.0.4 and mor...

Fedora 44 : chromium (2026-5551bc920f)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5551bc920f advisory. Automatic update for chromium-143.0.7499.192-1.fc44. Changelog Wed Jan 7 2026 Than Ngo - 143.0.7499.192-1 - Update tp 143.0.7499.192 High CVE-2026-0628:...

CVE-2025-61782 Open Redirect in OpenCTI's SAML Authentication Flow

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint /auth/saml/callback. By manipulating the RelayState parameter, an attacker can...

CVE-2025-61782 Open Redirect in OpenCTI's SAML Authentication Flow

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint /auth/saml/callback. By manipulating the RelayState parameter, an attacker can...

CVE-2019-16899

In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PMV3!CTagInfoThreadBase::GetNICInfo+0x0000000000512918...

binary-exploitation-labs

Binary Exploitation Labs This repository is my long-term pu...

AutoVulnPHP: LLM-Powered Two-Stage PHP Vulnerability Detection and Automated Localization

PHP's dominance in web development is undermined by security challenges: static analysis lacks semantic depth, causing high false positives; dynamic analysis is computationally expensive; and automated vulnerability localization suffers from coarse granularity and imprecise context. Additionally,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000402)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000402 advisory. The flowdissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking vulnerability, aka CID-55667441c84f. This occurs because the auto...

SUSE CVE-2025-64708

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, in previous authentik versions, invitations were considered valid regardless if they are expired or not, thus relying on background tasks to clean up expired ones. In a normal scenario this can take up to 5...

Exploit for Use After Free in Apple Safari

CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and...

EUVD-2025-206239

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a low privileged user member can invite a high privileged user. At first, the application will throw an error, but if the attacker clicks th...

com.vaadin:vaadin (>=23.1.0, <=23.1.17), com.vaadin:vaadin-jandex (>=23.1.0, <=23.1.17) +2 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=23.1.0, <=23.1.17)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =23.1.0, =23.1.0, =23.1.0, =23.1.0, =2.5.2, =2.5.3 Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.9.0, <=24.9.6) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.9.0, <=24.9.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.9.0, =24.9.0, =24.9.6 Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.7.0, <=24.8.13) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.8.13)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.8.13 Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.7.0, <=24.8.13) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.7.0, <=24.8.13)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.7.0, =24.7.0, =24.8.13 Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

com.vaadin:vaadin (>=24.9.0, <=24.9.6) potentially affected by CVE-2025-15022 via com.vaadin:vaadin-spreadsheet-flow (>=24.9.0, <=24.9.6)

com.vaadin:vaadin-spreadsheet-flow MAVEN version =24.9.0, =24.9.0, =24.9.6 Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...