CVE-2026-85628

CVE-2026-85628 affects the DuoxMe application and VEO / VEO-XS Wi-Fi monitors (Fermax). During the pairing process, home Wi-Fi credentials are transmitted in cleartext over Wi-Fi Direct , allowing an attacker on the same Wi-Fi Direct network to intercept the network password. The vulnerability ex...

SUSE-SU-2026:23742-1 Security update for kbd

This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441...

Malicious code in process-mite (npm)

This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

MAL-2026-16224 Malicious code in process-mite (npm)

This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

SUSE-SU-2026:4207-1 Security update for kbd

This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441...

Malicious code in swnwall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a On require/import, index.js invokes initialize which spawns loader.js as a detached, hidden background child process detached: true, windowsHide: tru...

CVE-2026-76559

The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the failure to properly validate URLs during the import process , allowing users with the import capability (such as administrators) to force the sit...

EUVD-2026-80183

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

Exploit for Heap-based Buffer Overflow in Microsoft

!Rulehttps://img.shields.io/badge/RULE-SOC335-00FF41?style=fo...

PT-2026-93419

Name of the Vulnerable Software and Affected Versions DuoxMe application versions prior to 4.3.4 VEO and VEO-XS Wi-Fi monitor firmware versions prior to 01.50.001 Description Home Wi-Fi credentials are transmitted without encryption during the pairing process between the DuoxMe application and VE...

PT-2026-94068

Name of the Vulnerable Software and Affected Versions Uber Kraken versions 0.1.0 through 0.1.29 Description An issue exists where the application fails to validate the tag parameter in the '/tags/tag' endpoint. This allows unauthenticated attackers to perform directory traversal by using...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38418)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the getSlaveUpdate function. Attackers can exploit this vulnerability by sending specially crafted POST...

CVE-2026-20135: Double Free

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...

PT-2026-93954

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description An issue in the TLS 1.3 implementation allows an unauthenticated remote attacker to cause a device to reload unexpectedly, leading to a denial of...

PT-2026-93452

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Micro Engine Scheduler MES, which fails to perform heavy-weight Translation Lookaside Buffer TLB invalidation after unmapping queues. This allows in-flight...

CVE-2026-91843 - Stack overflow in login process to the Security Management and Log Servers

Symptoms - Issue: A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. This issue received the ID CVE-2026-91843 and a CVSS score of 9.8. Affected Products: Security Management Server, Multi-Domain Security Management...

PT-2026-93839

Name of the Vulnerable Software and Affected Versions node-opcua versions 2.0.0 through 2.169.0 Description A combination of bugs in the client implementation leads to unlimited TCP socket accumulation in the FIN-WAIT-2 state during automatic reconnection, resulting in memory exhaustion and proce...

CVE-2026-86089: Missing Authorization

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

PT-2026-93932

Name of the Vulnerable Software and Affected Versions Apache NiFi version 2.11.0 Description An authorization flaw exists in the REST API methods used to list migration sources and submit migration requests when moving version-controlled Process Group contents into a Connector. The system only...

CVE-2026-82561: Missing Authorization

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...