CVE-2026-15969 CVE-2026-15969

SGLang contains an unauthenticated RCE in /loadloraadapterfromtensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads...

Metasploit Framework 6.5 Released

Today we’re proud to announce that Metasploit Framework version 6.5 has been released. Over the past two years, with the help of countless contributors, we’ve added 422 new modules along with a whole slew of new features. Malleable C2 Profiles for HTTP One of the latest and most requested feature...

CVE-2026-54635

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup stores...

CVE-2026-54635

CVE-2026-54635 affects pytonapi 2.0.0–2.2.0, where TonapiWebhookDispatcher fails to validate the Authorization header for webhook handlers registered with a documented path (custom path). The setup() logic only stores bearer tokens for default suffix paths, so self._tokens.get(path) returns None ...

MAL-2026-11138 Malicious code in json-schema-inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 023b104d04c30fccd05f5db5842a2d8735c572eb13cfbb5ca7ba763eeb525429 The package advertises itself as a JSON/XML schema validator, but both public entry points validateJson, validateXml in lib/core.js invoke a trigger...

MAL-2026-11132 Malicious code in bianira-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...

MAL-2026-11128 Malicious code in app-soda-layer (npm)

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook test.js. It harvests Solana keypairs id.json, config.toml and .env secrets, then installs an operator-supplied SSH key into /.ssh/authorizedkeys and opens port 22 f...

CVE-2026-66031

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

Denial Of Service (DoS)

vLLM is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of prompt embedding payloads for models using M-RoPE, which allows an authenticated attacker to trigger an assertion failure and crash the entire server by sending a crafted /v1/completions request...

Linux Distros Unpatched Vulnerability : CVE-2026-56816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's Http3FrameCodec buffers incoming data f...

GO-2026-5543 Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp

Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp...

Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities

The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including: - The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily...

PT-2026-64438

Summary An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead ...

CVE-2026-47769 APIFold Vulnerable to Unauthenticated Webhook Event Injection

APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the /webhooks/:serverSlug/:eventName endpoint accepts arbitrary unauthenticated JSON and stores it in Redis and the...

CVE-2026-65904

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-65902

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service...

CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

EUVD-2026-48273

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...