ROS-20260624-73-0038

The vulnerability in curl is related to insufficient protection of registration data. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2026-51662

Name of the Vulnerable Software and Affected Versions GeoVision GV-I/O Box 4E version 2.09 Description OS command injection flaws exist in the libNetSetObj.so internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially...

ROS-20260624-73-0043

The vulnerability in python-aiohttp is related to an incorrect restriction on the path name of the directory. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

Pentaho Data Integration & Analytics Permission Bypass

The vulnerability of the Hitachi Vantara Pentaho Data Integration & Analytics software for data integration and analysis is related to the improper assignment of permissions for a critical resource. Exploiting this vulnerability may allow an attacker operating remotely to gain access to read,...

PT-2026-52123

Name of the Vulnerable Software and Affected Versions ATEN Unizon affected versions not specified Description A directory traversal flaw exists in the writeFileToHttpServletResponse function. The issue is caused by insufficient validation of a user-supplied path before it is used in file...

Malicious code in security-alerts-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f881805b709189d00bc52dc57c407bfecdae44fb343f92634a301c31525f6b0 Despite advertising itself as a breach-monitoring SDK, this package executes a remote-access trojan and credential harvester against any installer th...

CVE-2026-56695 OpenHarness - Cross-Session Disclosure via /resume and /summary Commands

OpenHarness ohmo gateway /resume and /summary slash commands default remoteinvocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and...

postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...

WhatsApp VBScript Campaign Uses Fake Documents to Install ManageEngine RMM Tool

Direct messages sent via WhatsApp are being used to distribute malicious Visual Basic Script VBScript files that lead to the installation of legitimate Remote Monitoring and Management RMM software. Per findings from Kaspersky, the active campaign is targeting users of WhatsApp Desktop and WhatsA...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to access control errors. Exploiting this vulnerability could allow an attacker to gain full control over the...

Portainer Information Disclosure

The vulnerability of the Portainer container management platform is related to the disclosure of information through query strings. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

User Remote Access Agent Privilege Escalation

The vulnerability of the Prisma Access Agent, a user remote access agent, relates to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow attackers to enhance their privileges...

ROS-20260623-73-0048

The vulnerability of the pgAdmin 4 database management tool is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to gain access to LDAP account information remotely...

CVE-2026-44272

Dell Wyse Management Suite WMS, versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-44271

Dell Wyse Management Suite (WMS) prior to version 2605 is affected by an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A low-privilege, remote attacker could exploit this with network access to gain unauthorized access. Affected component is the W...

CVE-2026-44271

Dell Wyse Management Suite WMS, versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-44271

Dell Wyse Management Suite WMS, versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-44271

Dell Wyse Management Suite WMS, versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

EUVD-2026-38345

Dell Wyse Management Suite WMS, versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-44272

Dell Wyse Management Suite (WMS) is affected by an SQL Injection vulnerability (Improper Neutralization of Special Elements used in SQL commands) in versions prior to WMS 2605. A low-privilege, remotely connected attacker could exploit this to achieve unauthorized access. CVSS 3.1 base metrics in...