Exploit for CVE-2026-100721

CVE-2026-100721 — vm2 NodeVM external allowlist bypass Python...

Server-Side Request Forgery (SSRF)

jackson-databind is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to InetAddress.getByName resolving attacker-controlled input, which allows an attacker to trigger DNS requests from the server and probe or identify internal hosts...

Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

Multiple perl vulnerabilities impact AIX.

IBM SECURITY ADVISORY First Issued: Mon Sep 28 00:55:59 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/perladvisory14.asc Security Bulletin: Multiple perl vulnerabilities impact AIX...

CVE-2026-82929: Use of Hard-coded Cryptographic Key

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

PT-2026-99962

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 17.0.9 Description Authenticated users with access to the GraphQL api module interface can execute arbitrary shell commands. The issue occurs because the PBX API module documentation generator uses an authenticated ho...

Medium: runc

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

ROS-20260928-73-0066

The vulnerability of the nvmefcdeleteassociation function in the drivers/nvme/host/fc.c file of the NVMe over Fibre Channel driver for the Linux operating system is related to multiple releases of the same resource or descriptor. Exploiting this vulnerability could allow an attacker to cause a...

Linux Distros Unpatched Vulnerability : CVE-2026-89134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A certificate with no dNSName SAN but another SAN type present e.g. registeredID or iPAddress bypassed the Subject CN dNSName name-constraint check. The CN-as-D...

PT-2026-99863

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

ROS-20260928-73-0108

The vulnerability of the nvmefccreateassociation function in the drivers/nvme/host/fc.c file of the Linux kernel’s NVME driver is related to the lack of synchronization. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-87799: Improper Link Resolution Before File Access

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...

PT-2026-99889

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.2 through 4.0.13 Canonical LXD versions 5.0.0 through 5.0.9 Canonical LXD versions 5.21.0 through 5.21.7 Canonical LXD versions 6.0.0 through 6.9.x Description A path traversal issue exists in the btrfs storage drive...

CVE-2026-85185: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

CVE-2026-85526: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...

PT-2026-99756

Name of the Vulnerable Software and Affected Versions DevaslanPHP project-management versions 1.2.1 through 1.2.4 DevaslanPHP project-management version v2.0.0-beta1 Description In the Jira Import component, the updateJiraProjects function within the /jira-import file is susceptible to server-sid...

DEBIAN-CVE-2026-96282

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...

CVE-2026-96282

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...

CVE-2026-96282

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...

UBUNTU-CVE-2026-96282

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be...