CVE-2026-63911

A flaw was found in the Linux kernel's xfrm: iptfs component. This vulnerability arises from incorrect handling of runtime data when cloning Security Associations SAs. If a state migration fails, the cloned state can improperly share memory with the original, leading to use-after-free and...

metasploit-framework v6.4.144

Metasploit Framework The Metasploit Framework is an open-source tool released under a BSD-style license. For detailed licensing information, refer to the COPYING file. Latest Version Access the latest version of Metasploit from the Nightly Installers page. Documentation Comprehensive documentatio...

angr v9.3.0

angr angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot. Project Links Homepage: https://angr.io Project...

lback-framework (>=0.1.0, <=1.0.1) potentially affected by CVE-2026-59890 via setuptools (80.3.0)

setuptools PYPI version 80.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - lback-framework =0.1.0, =1.0.1 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

EUVD-2026-42326

hono/jsx does not isolate context per request, leading to cross-request data disclosure...

EUVD-2026-42327

Hono: Server-Side XSS via JSX Escaping Bypass in cx Utility...

homeassistant-stubs (>=2026.5.0b0, <=2026.6.0b4), pytest-homeassistant-custom-component (>=0.13.326, <=0.13.335) +1 more potentially affected by CVE-2026-64825 via homeassistant (>=2026.5.0b0, <=2026.6.0b4)

homeassistant PYPI version =2026.5.0b0, =2026.5.0b0, =0.13.326, =1.0.15, =1.0.24 Source cves: CVE-2026-64825 Source advisory: OSV:GHSA-5HXG-R395-FQXX...

homeassistant-stubs (>=2026.5.0b0, <=2026.6.0b4), pytest-homeassistant-custom-component (>=0.13.326, <=0.13.335) +1 more potentially affected by CVE-2026-64825 via homeassistant (>=2026.5.0b0, <=2026.6.0b4)

homeassistant PYPI version =2026.5.0b0, =2026.5.0b0, =0.13.326, =1.0.15, =1.0.24 Source cves: CVE-2026-64825 Source advisory: GHSA-5HXG-R395-FQXX...

Kittysploit-framework V1.1.2

KittySploit Framework The Next-Gen Exploitation Engine for Modern Red Teams Website • Wiki • Usage Guide • Marketplace Modular • Extensible • AI-Powered Why KittySploit? While traditional tools struggle with modern web architectures and automated defense, KittySploit redefines the offensive...

oxo v2.9.8

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

n8n-nodes-metasploit

n8n-nodes-metasploit !npm versionhttps://img.shields.io/n...

EUVD-2026-44400

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability...

CVE-2026-47122

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

EUVD-2026-46275

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After performedStage1Installation = YES, new connections to the...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

EUVD-2026-46259

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CVE-2026-47121

Sparkle vulnerability CVE-2026-47121 (affecting macOS AutoUpdate) arises from a defense-in-depth gap in delta application. An archive item can create a symlink in the destination tree and a subsequent file write may traverse the symlink path, allowing writes outside the intended destination when ...