CVE-2026-13482

A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component User ID Handler. The manipulation results in use of weak hash. The attack may be performed from remote. This attack is characterized by hig...

[SECURITY] Fedora 43 Update: moby-engine-29.6.0-1.fc43

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This means they can run anywhere, from your laptop to the largest EC2 compute instance a nd everything in between =E2=80=94 and...

CVE-2026-13504: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component Mail Compose Page. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed...

Linux Distros Unpatched Vulnerability : CVE-2025-60464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gfseiloadfromstateinternal function /filters/seiload.c of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Servi...

PT-2026-53103

Name of the Vulnerable Software and Affected Versions glpi-project glpi versions 11.0.5 through 11.0.7 Description An authorization bypass exists in the Document Handler component within the file 'front/document.send.php'. The issue occurs in the Document::canViewFile function when processing the...

PT-2026-53115

Name of the Vulnerable Software and Affected Versions code-projects Project Management System version 1.0 Description Cross site scripting XSS occurs in the Mail Compose Page component within the /mail.php endpoint. This issue allows a remote attacker to execute malicious scripts through the...

zuixingongju-resources

zuixingongju-resources HW Red Team Arsenal – Resource fil...

CVE-2026-53523

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:19+00:00| published-proof-of-concept| https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx...

PT-2026-53221

Name of the Vulnerable Software and Affected Versions Delta Electronics DTM Soft affected versions not specified Description The software is susceptible to the deserialization of untrusted data, which can allow an attacker to execute arbitrary code. Real-world exploitation has been observed where...

NPM: pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

NPM: pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.0...

GHSA-HWX4-2J3J-G496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install - ignore-scripts to replace...

devops-message-service-project-2022 (>=1.2.0, <=1.3.0), quantplay (>=1.4.51, <=1.4.53) +1 more potentially affected by CVE-2026-48802 via python-engineio (3.13.0)

python-engineio PYPI version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-engineio and may be impacted: - devops-message-service-project-2022 =1.2.0, =1.4.51, =1.0.2, =1.0.4 Source cves: CVE-2026-48802 Source advisory:...

devops-message-service-project-2022 (>=1.2.0, <=1.3.0), quantplay (>=1.4.51, <=1.4.53) +1 more potentially affected by CVE-2026-48809 via python-engineio (3.13.0)

python-engineio PYPI version 3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-engineio and may be impacted: - devops-message-service-project-2022 =1.2.0, =1.4.51, =1.0.2, =1.0.4 Source cves: CVE-2026-48809 Source advisory:...

CVE-2026-48750

creationtimestamp| type| source ---|---|--- 2026-06-26 20:35:25+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-73hr-m85f-64v9 2026-07-07 20:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3htunogl2b 2026-08-21 16:07:49+00:00| see...

CVE-2026-52782

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects//settings/projectstorages/ via PATCH parameter "storagesprojectstorageprojectfolderid" leads to Access to Unauthorized Resources. A project-admin in one project can...

CVE-2026-52779

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries...

CVE-2026-49355

OpenProject is open-source, web-based project management software. Prior to 17.4.0, GET /api/v3/meetings/:meetingid/agendaitems/:agendaitemid discloses private work package data from a linked work package that belongs to a private/inaccessible project. This vulnerability is fixed in 17.4.0...

CVE-2026-44732

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify existing documents. The target document is loaded with visibility checks and then updated. During update, attacker-controlled attributes are...

CVE-2026-44734

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user to modify the name, filters, and grouping of any Public co...

Exposed Dangerous Method or Function

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via the local HTTP server's permissive CORS policy, which sends...