lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting

WordPress Panda Pods Repeater Field before 1.5.4 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. This can be leveraged against a user who has at least Contributor permission. An attacker can also steal...

lava

LAVA: Adición Automatizada de Vulnerabilidades a Gran Escala Evaluar y mejorar las herramientas de búsqueda de errores es actualmente difícil debido a la escasez de corpus de verdad fundamental es decir, software que tiene errores conocidos con entradas que los desencadenan. LAVA intenta resolver...

Exploit for CVE-2026-13043

🕷️ CVE-2026-13043 - Panda / WatchGuard Kernel Memory Access...

lava v3.3.1

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

lava v3.3.0

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyteaka Mustang Panda has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kernel-mode rootkit that can hide and protect malicious processes, files, registry objects, and command-and-control C2 network information. Russian...

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network VPN and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing...

Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks

The China-aligned espionage group Mustang Panda is running two campaigns against the Indian government and hydropower targets, deploying new malware and turning a legitimate cloud service into its command channel. Acronis Threat Research Unit found active compromises inside Indian government...

com.github.jsimone:webapp-runner (7.0.88.0), com.github.pandafw:panda-gear (>=1.2.0, <=1.5.3) +3 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (7.0.88)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.88 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 7.0.88.0 - com.github.pandafw:panda-gear...

com.github.jsimone:webapp-runner (7.0.88.0), com.github.pandafw:panda-gear (>=1.2.0, <=1.5.3) +3 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (7.0.88)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.88 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 7.0.88.0 - com.github.pandafw:panda-gear...

com.github.jsimone:webapp-runner (8.5.45.0), com.github.jsimone:webapp-runner-main (8.5.45.0) +12 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.45)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.45 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 8.5.45.0 -...

com.github.jsimone:webapp-runner (7.0.88.0), com.github.pandafw:panda-gear (>=1.2.0, <=1.5.3) +3 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.88)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.88 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 7.0.88.0 - com.github.pandafw:panda-gear...

com.github.jsimone:webapp-runner (7.0.88.0), com.github.pandafw:panda-gear (>=1.2.0, <=1.5.3) +3 more potentially affected by CVE-2026-43512 via org.apache.tomcat.embed:tomcat-embed-core (7.0.88)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.88 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 7.0.88.0 - com.github.pandafw:panda-gear...

com.github.jsimone:webapp-runner (7.0.88.0), com.github.pandafw:panda-gear (>=1.2.0, <=1.5.3) +3 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.88)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.88 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.github.jsimone:webapp-runner 7.0.88.0 - com.github.pandafw:panda-gear...

Mustang Panda Hits India and S. Korea with Updated LOTUSLITE Backdoor

Acronis reveals Mustang Panda is using an updated version of LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works...

Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles

Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that's distributed via a theme related to India's banking sector. "The backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations...

CVE-2026-39658

Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through = 1.5.12...

EUVD-2026-20327

Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through = 1.5.12...

CVE-2026-39658

Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panda Pods Repeater Field: from n/a through = 1.5.12...