CVE-2026-102454 DigiWin｜EasyFlow .NET - Arbitrary File Upload

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

CLEANSTART-2026-BX08713 When returning errors, functions in the net/textproto package would include its input as part of the error

Security vulnerability affects the minio-operator package. When returning errors, functions in the net/textproto package would include its input as part of the error...

EUVD-2026-89433

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

ROS-20260930-73-0106

The vulnerability of the bondenslave function in the drivers/net/bonding/bondmain.c file of the Linux kernel network device driver is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or...

ROS-20260930-73-0010

The vulnerability of the allocchooseargmap function in the net/ceph/osdmap.c module, which is part of the Linux kernel’s networking functions, relates to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

ROS-20260930-73-0074

The vulnerability of the rxrpcrecvmsg function in the net/rxrpc/recvmsg.c module, which supports RxRPC session sockets in Linux kernels, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

PT-2026-103077

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Insecure Deserialization allows unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content. Deserialization is the proces...

CVE-2026-102456: Improper Neutralization of Special Elements used in an SQL Command

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents...

ROS-20260930-73-0012

The vulnerability of the bpfprogtestrunxdp function in the net/bpf/testrun.c module, which is part of the networking functions in the Linux kernel, relates to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to cause service...

ROS-20260930-73-0006

The vulnerability of the skbsegmentlist function in the net/core/skbuff.c module of the Linux kernel is related to resource exhaustion. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-103078

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An SQL Injection flaw allows authenticated remote attackers to inject arbitrary SQL commands, enabling them to read sensitive database contents. Recommendations At the moment, there is ...

ROS-20260930-73-0025

The vulnerability of the ipgreheader function in the net/ipv4/ipgre.c module of the Linux kernel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

ROS-20260930-73-0034

The vulnerability of the updateeth regs async function in the drivers/net/usb/pegasus.c file of the Linux network adapter driver module is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

ROS-20260930-73-0110

The vulnerability of the drivers/net/can/usb/usb8dev.c component in the Linux kernel is related to improper memory release before deleting the last reference. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-103080

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Missing authentication allows unauthenticated remote attackers to obtain the plaintext passwords of other users through a specific API endpoint. Recommendations At the moment, there is ...

PT-2026-103076

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file upload flaw allows privileged remote attackers to upload and execute web shell backdoors, which can lead to arbitrary code execution on the server. Recommendations At...

CVE-2026-102458: Missing Authentication for Critical Function

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API...

CVE-2026-102455: Deserialization of Untrusted Data

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content...

PT-2026-103079

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. Recommendations At the moment, there is no information about a newe...