PT-2026-69440

Name of the Vulnerable Software and Affected Versions GNU cpio affected versions not specified Description Path Traversal exists in the tar archive extraction functionality. When extracting a tar archive in copy-in mode using the --no-absolute-filenames option, the extracted file name is...

📄 DjangoCRM 2.4.0 Debug Information Disclosure

A proof of concept exploit for an information disclosure vulnerability in DjangoCRM version 2.4.0. The vulnerability exists because affected installations ship with Django debug mode enabled, allowing unauthenticated attackers to trigger technical error pages that disclose sensitive application...

CVE-2026-66484: Improper Limitation of a Pathname to a Restricted Directory

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

PT-2026-69896

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-microsoft-azure versions prior to 14.1.0 Description The Azure Key Vault secrets backend in the Microsoft Azure provider resolves a team-scoped Connection or Variable id using a team-agnostic lookup if the initial...

PT-2026-69406

Name of the Vulnerable Software and Affected Versions Smart Switch versions prior to 3.7.72.6 Description Insufficient verification of data authenticity in the trouble scanning mode allows adjacent attackers to spoof device identity. Recommendations Update to version 3.7.72.6 or later...

CVE-2026-68870: Authorization Bypass Through User-Controlled Key

The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a...

PT-2026-80681

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret...

PT-2026-80679

The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...

PT-2026-105535

The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret...

PT-2026-69656

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the detect link and local sink function within the drm/amd/display component. The prev sink reference is retained using the dc sink retain function at the start o...

Linux Distros Unpatched Vulnerability : CVE-2026-68326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiexprocessuapevent handles EVENTUAPSTAASSOC by exposing the reassociation request IEs tha...

Alibaba Cloud Linux 3 : 0246: openssh (ALINUX3-SA-2026:0246)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0246 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-55653: A flaw was found in OpenSS...

CVE-2026-19341

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has...

Ghostlink_lite

GHOSTLINK // Enterprise Cyber Command Center & Defensive Scann...

Exploit for CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/s...

dnsglobe v0.5.0

dnsglobe A global DNS propagation checker for your terminal — a Rust TUI that queries 34 public DNS resolvers around the world in parallel, compares their answers, and shows the propagation of your record on a world map. Think dnschecker.org / whatsmydns.net, but in your terminal, with watch mode...

prismor v1.39.0

Prismor Runtime security hooks for Claude Code, Codex, and other AI coding agents. Prismor can also be used in observe mode to see agent session activity and dangerous actions in a local self-serve dashboard Website • Onboard with Skill !Trae / Trae CNht...

SUSE CVE-2026-43631

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending...

KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

...

prismor v1.38.1

Prismor Runtime security hooks for Claude Code, Codex, and other AI coding agents. Prismor can also be used in observe mode to see agent session activity and dangerous actions in a local self-serve dashboard Website • Onboard with Skill !Trae / Trae CNht...