PT-2026-73056

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored Cross-Site Scripting XSS occurs because attribute-view field names are stored without HTML escaping and interpolated directly into option elements using innerHTML within the sort menu. An...

PT-2026-72139

Name of the Vulnerable Software and Affected Versions Pinpoint Booking System – Version 2 versions prior to 2.9.9.6.9 Description Unauthenticated attackers can manipulate the checkout price of bookable products tied to a booking calendar. The issue occurs because the dopbsp woocommerce add to car...

PT-2026-73051

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape table column width values, which allows injection into style attributes. An attacker can use the 'setAttrViewColWidth' AP...

PT-2026-73050

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject...

PT-2026-73057

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the unicode2Emoji function due to a failure to sanitize codepoint branch output. This allows attackers to create document icons containing hex-encoded markup. Wh...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

EUVD-2026-58799

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680

Cockpit CMS 2.14.0 and earlier exposes a command-injection vulnerability in the FFmpeg integration. An authenticated user with assets/upload can upload a video file whose filename contains shell metacharacters; the unsanitized filename is interpolated into a shell command executed via Process::fr...

rustinel v1.3.0

Rustinel Open-source endpoint detection for Windows, Linux, and macOS. Native telemetry to Sigma, YARA, IOC detection, and SIEM-ready alerts. Written in Rust. Website | Docs | Download | SIEM demos Quick Start Rustinel ships release archives with a binary, default config, demo rules, and a logs/...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

EUVD-2026-58685

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

Directory Traversal

Spring Integration is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of file paths received from malicious or compromised FTP/SFTP/SMB servers, which allows an attacker to write arbitrary content to files outside the configured local directory...

ejpt-mission-framework-poc

eJPT Mission Framework An evidence-backed Markdown workflow f...

kubeshark v53.4.0

Network Observability for SREs & AI Agents Live Demo · Docs Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics. What you can do: Download Retrospective PCAPs — cluster-wide packet...

GO-2026-5363 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr...

CVE-2026-73680: Improper Neutralization of Special Elements used in an OS Command

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

The vulnerability of the RIB Kernal component in the XML-based asynchronous messaging integration platform of Oracle Retail Integration Bus allows a attacker to gain full control over the application.

The vulnerability of the RIB Kernal component in the XML-based asynchronous messaging integration platform of Oracle Retail Integration Bus is related to insecure privilege management. Exploiting this vulnerability could allow an attacker to gain full control over the application using the HTTP...

The vulnerability of the RIB Kernal component in the XML-based asynchronous messaging integration platform of Oracle Retail Integration Bus allows a attacker to gain full control over the application.

The vulnerability of the RIB Kernal component in the XML-based asynchronous messaging integration platform of Oracle Retail Integration Bus is related to improper code generation management. Exploiting this vulnerability can allow an attacker to gain full control over the application using the HT...