Element Server Suite 安全漏洞

Element Server Suite is a community edition of the Element open-source server suite. There are security vulnerabilities in Element Server Suite Community Edition ESS Community, which stem from an insecure method for generating Matrix server keys. This could allow network attackers to recreate the...

CVE-2026-25062

Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments.key from the imported JSON is passed directly to path.joinrootPath, node.key and then read using fs.readFile without validation. By embedding path traversal...

Updated golang packages fix security vulnerabilities

net/http: memory exhaustion in Request.ParseForm. CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives. CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level. CVE-2025-61730 cmd/go: bypass of flag sanitization can lead to...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Microsoft

CVE-2026-21509 Mitigation Script Traditional Chinese version:...

Security update for go1.25

This update for go1.25 fixes the following issues: Update to version 1.25.7. Security issues fixed: CVE-2025-61732: cmd/go: discrepancy between Go and C/C++ comment parsing allows for C code smuggling bsc1257692. CVE-2025-68121: crypto/tls: Config.Clone copies automatically generated session tick...

TemizlikYolda 安全漏洞

TemizlikYolda is an online domestic service booking platform operated by the Turkish company TemizlikYolda. Versions of TemizlikYolda prior to 11022026 contained security vulnerabilities. These vulnerabilities stemmed from bypassing authorization through user control keys, potentially allowing...

Pion DTLS 信息泄露漏洞

Pion DTLS is an open-source implementation of the DTLS Data Transfer Layer Security Protocol based on the Go language. Versions of Pion DTLS from 1.0.0 to 3.1.0 have a vulnerability related to information leakage. This vulnerability stems from the use of random numbers for AES GCM encryption, whi...

MAL-2026-847 Malicious code in requests-auth-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 03bb4c04410c4e3c58d7292eb47f8f76a2fbe5265abea29826ac910e890350d0 During installation, package installs a script that listens for remote commands and executes them. The script is also added to autostart configuration and...

PYSEC-2026-2141

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the publickeyfromnumbers or EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey and loadpempublickey functions do not verify that the...

DEBIAN-CVE-2026-26007

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the publickeyfromnumbers or EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey and loadpempublickey functions do not verify that the...

CVE-2026-26007

CVE-2026-26007 describes a vulnerability in the cryptography package where public_key_from_numbers, EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key() do not validate that a key point belongs to the expected prime-order subgroup. This allows small-subgroup k...

CVE-2025-7432

DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys through a DPA attack...

CVE-2026-25993 EverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / requestpath values—derived from the urlkey stored in the database—into SQL statements via string concatenation and passes them to execute. As a result, if a malicio...

Malicious code in chai-as-approved (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f623e45c7742d5a9190e736f51777bae77297d5abeafd8c21679bd40b729034b The package chai-as-approved was found to contain malicious code. Source: ghsa-malware da0fdbfe00f6e097edd25bc90bfbac03e97c871951995b5d58f06b348d39c8...

Output Injection

Badkeys is vulnerable to output injection. The vulnerability is due to improper handling and sanitization of control characters in input, which allows an attacker to inject malicious content that produces misleading or manipulated command-line output when scanning DKIM keys, SSH keys, or filename...

munge 安全漏洞

Munge is an identity verification service developed by Chris Dunlap, used for creating and verifying credentials. Versions of MUNGE prior to 0.5.18 contained security vulnerabilities; these vulnerabilities were caused by buffer overflows in Munged, which could lead to the disclosure of encrypted...

Dinibh Patrol Tracking System 安全漏洞

Dinibh Patrol Tracking System is an inspection management platform developed by the Turkish company Dinibh. The versions of Dinibh Patrol Tracking System 10022026 and earlier contained security vulnerabilities. These vulnerabilities stemmed from bypassing authorization using user control keys,...

OpenSSH 10.2p1 Authorized Keys Persistence Tool

This Metasploit Auxiliary module establishes persistent access to remote systems by adding an SSH public key to a target user's authorizedkeys file after successful authentication. The module requires valid SSH credentials password or private key and supports both Unix-like and Windows SSH...

PT-2026-7473

Name of the Vulnerable Software and Affected Versions cryptography versions prior to 46.0.5 Description A validation flaw exists where the functions public key from numbers or EllipticCurvePublicNumbers.public key, EllipticCurvePublicNumbers.public key, load der public key, and load pem public ke...

WordPress plugin WCFM Membership 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...