PT-2026-22514

Name of the Vulnerable Software and Affected Versions FascinatedBox lily versions prior to 2.3 Description A flaw exists in FascinatedBox lily, specifically within the eval tree function of the src/lily emitter.c file, leading to a null pointer dereference. This issue is exploitable locally. The...

PT-2026-22501

A security flaw has been discovered in ChaiScript up to 6.1.0. The impacted element is the function chaiscript::Boxed Number::get as of the file include/chaiscript/dispatchkit/boxed number.hpp. Performing a manipulation results in memory corruption. The attack requires a local approach. The explo...

EUVD-2026-9069

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages...

CVE-2026-28516

creationtimestamp| type| source ---|---|--- 2026-02-28 00:59:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuzi6em5h2o 2026-04-14 20:15:55+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendciminstallsqlirce.rb 2026-04-15...

EUVD-2026-9098

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitation. If an attacker can modify the...

Cross-site Scripting (XSS)

Overview net.sourceforge.pmd:pmd-core is an extensible multilanguage static code analyzer. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the vbhtml or yahtml report formats, which include rule violation messages in HTML output, in renderFileViolations and...

OSV-2026-324 Security exception in java.base/java.util.Arrays.copyOfRange

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=488130836 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOfRange java.base/java.lang.StringUTF16.newString java.base/java.lang.StringBuilder.toString...

CVE-2026-28517

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitization. If an attacker can modify the...

CVE-2026-28517 openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitization. If an attacker can modify the...

CVE-2026-28517

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitization. If an attacker can modify the...

CVE-2026-28517 openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in reportnetworkmap.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec without validation or sanitization. If an attacker can modify the...

CVE-2026-28338

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's vbhtml and yahtml report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains...

CVE-2026-28338 PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's vbhtml and yahtml report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains...

Data Broker Breaches Fueled Nearly $21 Billion in Identity-Theft Losses

A report copublished by WIRED sparked a probe into opt-out pages hidden by data brokers. Now congressional Democrats say breaches tied to the industry have cost people tens of billions of dollars...

PT-2026-22427

Name of the Vulnerable Software and Affected Versions openDCIM versions 23.04 through commit 4467e9c4 Description The application retrieves the dot configuration parameter from the database and passes it directly to the exec function without validation or sanitation. If an attacker can modify the...

Crypt::SysRandom::XS 安全漏洞

Crypt::SysRandom::XS is a Perl library developed by LEONT’s individual developers, designed for generating encrypted random numbers. Versions of Crypt::SysRandom::XS prior to 0.010 contained security vulnerabilities. These vulnerabilities stemmed from the XS function randombytes, which did not...

PT-2026-22398

Name of the Vulnerable Software and Affected Versions PMD versions prior to 7.22.0 Description PMD, a static code analyzer, contains a flaw where its vbhtml and yahtml report formats do not properly escape characters when inserting rule violation messages into HTML output. Analyzing untrusted...

PT-2026-36464

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID multitouch component where a device can respond to a feature request using a report ID that differs from the one requested. This discrepancy can lead to confusio...

openDCIM 操作系统命令注入漏洞

openDCIM is an open-source data center inventory management DCIM application. Version 23.04 of openDCIM contains a vulnerability related to operating system command injection. This vulnerability stems from the lack of validation or cleanup of user input in the reportnetworkmap.php file, which may...

GO-2025-4259 Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues in github.com/mattermost/mattermost-server

Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. ...