CVE-2026-8210 aandrew-me tgpt Update helper.go helper.Update command injection

A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS. Affected by this vulnerability is the function helper.Update of the file helper.go of the component Update Handler. The manipulation leads to command injection. Local access is required to approach this...

CVE-2026-8210

A security vulnerability has been detected in aandrew-me tgpt up to 2.11.1 on Linux/macOS. Affected by this vulnerability is the function helper.Update of the file helper.go of the component Update Handler. The manipulation leads to command injection. Local access is required to approach this...

PT-2026-39416

Name of the Vulnerable Software and Affected Versions andrew-me tgpt versions prior to 2.11.2 Description Command injection is possible in the Update Handler component via the Update function within the helper.go file. This issue requires local access to be exploited. Recommendations Update to a...

EUVD-2026-28403

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CVE-2026-8081

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CVE-2026-8081

CVE-2026-8081 affects router-for-me CLIProxyAPI 6.9.29. The vulnerability is a server-side request forgery in the API Tools handler (internal/api/handlers/management/api_tools.go) caused by manipulating the url argument. This enables remote exploitation as disclosed publicly. Remediation details ...

CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

SUSE CVE-2026-31748

In the Linux kernel, the following vulnerability has been resolved: comedi: medaq: Fix potential overrun of firmware buffer me2600xilinxdownload loads the firmware that was requested by requestfirmware. It is possible for it to overrun the source buffer because it blindly trusts the file format. ...

PT-2026-38545

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CVE-2026-31748

A flaw was found in the Linux kernel's comedi: medaq module. The me2600xilinxdownload function, responsible for loading firmware, does not adequately validate the length of the provided firmware data stream. This vulnerability allows for a buffer overrun, which can lead to memory corruption withi...

CVE-2026-31748 comedi: me_daq: Fix potential overrun of firmware buffer

In the Linux kernel, the following vulnerability has been resolved: comedi: medaq: Fix potential overrun of firmware buffer me2600xilinxdownload loads the firmware that was requested by requestfirmware. It is possible for it to overrun the source buffer because it blindly trusts the file format. ...

MAL-2026-3128 Malicious code in wm-plugin-teach-me-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8892d058e7f10e304a86eea230ef7fa8fbf9a76da1d09b60f5498305690d4bc The package wm-plugin-teach-me-widget was found to contain malicious code. Source: ghsa-malware...

Command-Injection

📄 Write-up : Command Injection - Filter Bypass Root-Me Challe...

CVE-2026-40588 blueprintUE: Authenticated Password Change Does Not Verify Current Password

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/slug/edit/ does not include a currentpassword field and does not verify the user's existing password before accepting a new one. Any attacker who obtains a valid authenticated session —...

GHSA-XQ8M-7C5P-C2R6 Auth0 Next.js SDK has Improper Proxy Cache Lookup

Description In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Which Projects are Affected? Users are affected if they meet all of the following preconditions: -...

EUVD-2026-23537

Auth0 Next.js SDK has Improper Proxy Cache Lookup...

Auth0 Next.js SDK has Improper Proxy Cache Lookup

Description In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Which Projects are Affected? Users are affected if they meet all of the following preconditions: -...

ctf-writeups

ctf-writeups Retos de HTB, TryHackMe y DFIR — documentado...

CVE-2026-40155

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if...