EUVD-2026-50993

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

EUVD-2026-50994

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-16610

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2026-64347

A flaw was found in the USB gadget composite driver in the Linux kernel. An issue with an empty check in the USBDTOTG handler can lead to reading from an invalid memory location. This can result in a kernel AddressSanitizer KASAN fault, potentially causing information disclosure or a denial of...

EUVD-2026-50967

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

Oracle Linux 10 : kernel (ELSA-2026-45114)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45114 advisory. - futex: Drop CLONETHREAD requirement for private default hash alloc Audra Mitchell RHEL-193518 CVE-2026-52973 - net: ipv6: fix NOREF dst use in seg6...

CVE-2026-67437 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

CVE-2026-64558

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkeypckmo handler implementation Explicitly check the length of the target buffer in the pkeypckmo implementation of the keytoprotkey handler function. The handler function fails, if the generated outpu...

CVE-2026-50558

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

Directory Traversal

Overview penelope-shell-handler is a Post-exploitation shell handler for authorized security testing Affected versions of this package are vulnerable to Directory Traversal in the download process when extracting tar archives from a remote session without validating archive member paths. An...

CVE-2026-50558

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

Exploit for OS Command Injection in Openhands

CVE-2026-33718 OpenHands is Vulnerable to Command Injection t...

PT-2026-65848

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey pckmo handler implementation Explicitly check the length of the target buffer in the pkey pckmo implementation of the key to protkey handler function. The handler function fails, if the generated...

NewStart CGSL MAIN 6.06 : keepalived Vulnerability (NS-SA-2026-0064)

The remote NewStart CGSL host, running version MAIN 6.06, has keepalived packages installed that are affected by a vulnerability: - In the vrrpipsetshandler handler fglobalparser.c of keepalived through 2.3.1, an integer overflow can occur. NOTE: this CVE Record might not be worthwhile because an...

PT-2026-65830

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocal download folder on tar archives returned by remote sessions without validating member paths, allowing a malicious ...

CVE-2026-62325

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

SUSE CVE-2026-64555

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSREL2 restore in kvmhyphandlemops kvmhyphandlemops resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpucpsr and writing the result directly into hardware. In...

EUVD-2026-49875

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...