Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure

High-value organizations located in South, Southeast, and East Asia have been targeted by a Chinese threat actor as part of a years-long campaign. The activity, which has targeted aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors, has been...

sunbird-portal 安全漏洞

sunbird-portal is an open-source portal developed by Sunbird-ED. Version 1.13.4 of sunbird-portal contains a security vulnerability, which can be exploited by cross-site request forgery attacks...

ThermaKube 安全漏洞

ThermaKube is a Kubernetes cluster monitoring and visualization tool released under the Open Source Labs beta version. There is a security vulnerability in ThermaKube, which stems from server-side request forgery...

OSS-CRS: Liberating AIxCC Cyber Reasoning Systems for Real-World Open-Source Security

DARPA's AI Cyber Challenge AIxCC showed that cyber reasoning systems CRSs can go beyond vulnerability discovery to autonomously confirm and patch bugs: seven teams built such systems and open-sourced them after the competition. Yet all seven open-sourced CRSs remain largely unusable outside their...

PT-2026-24122

Name of the Vulnerable Software and Affected Versions Misskey versions 10.93.0 through 2026.3.0 Description Misskey is a federated social media platform. A flaw exists that allows importing data belonging to other users because of insufficient ownership validation. The potential impact is...

LessPass 安全漏洞

LessPass is an open-source password manager developed by LessPass. Version 9.6.9 of LessPass contains a security vulnerability that stems from the storage of sensitive information in plaintext, which could allow attackers to obtain this sensitive data...

JFlow 安全漏洞

JFlow is a low-code BPM development platform open-sourced by Jinan Chicheng opencc in China. JFlow has a security vulnerability, which stems from incorrect operations on the function Calculate in the file src/main/java/bp/wf/httphandler/WFCCForm.java, potentially leading to injection attacks...

SourceCodester Patients Waiting Area Queue Management System 授权问题漏洞

The SourceCodester Patients Waiting Area Queue Management System is an open-source system developed by SourceCodester for managing patient waiting queues. Version 1.0 of the SourceCodester Patients Waiting Area Queue Management System contains a vulnerability related to authorization issues. This...

SourceCodester Resort Reservation System SQL注入漏洞

The SourceCodester Resort Reservation System is an open-source resort reservation system developed by SourceCodester. Version 1.0 of the SourceCodester Resort Reservation System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter “q” in the file...

DoraCMS 授权问题漏洞

DoraCMS is an open-source application developed by DoraCMS. It is a content management system built using Node.js, eggjs, and MongoDB. Version 3.0.x of DoraCMS has a vulnerability related to authorization. This vulnerability stems from improper handling of files/api/v1/mail/send, which may lead t...

FreshRSS 授权问题漏洞

FreshRSS is an open-source, free, and self-hosted RSS aggregator developed by FreshRSS. There are authorization issues with FreshRSS; these vulnerabilities stem from password verification logic flaws, allowing users to successfully pass verification even with incorrect passwords...

Messages 授权问题漏洞

Messages is an open-source email inbox software developed by La Suite numérique. Version 0.2.0 of Messages contains a vulnerability related to authorization issues. This vulnerability stems from operations on the ThreadAccessSerializer function in the file serializers.py, which may lead to improp...

VoiceSHIELD-Small: Real-Time Malicious Speech Detection and Transcription

Voice interfaces are quickly becoming a common way for people to interact with AI systems. This also brings new security risks, such as prompt injection, social engineering, and harmful voice commands. Traditional security methods rely on converting speech to text and then filtering that text,...

SourceCodester Employee Task Management System SQL注入漏洞

SourceCodester Employee Task Management System is an open-source employee task management system developed by SourceCodester. Versions of the SourceCodester Employee Task Management System prior to 1.0 contained a SQL injection vulnerability. This vulnerability stemmed from the handling of the Da...

itsourcecode Free Hotel Reservation System SQL注入漏洞

itsourcecode Free Hotel Reservation System is an open-source hotel reservation system developed by itsourcecode. Version 1.0 of the itsourcecode Free Hotel Reservation System contains a SQL injection vulnerability. This vulnerability arises from incorrect operations with the parameters amenid and...

Code-Projects Student Web Portal SQL注入漏洞

Code-Projects Student Web Portal is an open-source student portal developed by Code-Projects. Version 1.0 of Code-Projects Student Web Portal has a SQL injection vulnerability, which stems from the handling of the regpasswd parameter in the signup.php file, potentially leading to SQL injection...

PYSEC-2026-121

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the editpackage function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be...

CVE-2026-29193

Technical details for CVE-2026-29193 are not publicly available in the provided documents. No affected products, versions, root cause, or patch specifics are described beyond the initial entry. Monitor for updates from vendors and security advisories.

CVE-2026-27796

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service...

EUVD-2026-10117

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url...