SUSE CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsa...

EUVD-2026-108507

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server...

CVE-2026-46651

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket in goobi-viewer-core accepts download requests from unauthenticated users...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability (CVE-2026-11829)

Summary IBM MQ Appliance has addressed an improper validation vulnerability that could allow an authenticated attacker to cause a denial of service. Vulnerability Details CVEID:CVE-2026-11829 DESCRIPTION: IBM MQ could allow an authenticated attacker to cause a denial of service due to improper...

CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

CVE-2026-58497 Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A maliciou...

CVE-2026-58497

Prior to version 0.225.2 , Uni-CLI (specifically the @zenalexa/unicli package) is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of browser Origin header validation on its legacy JSON-RPC-over-HTTP MCP transport. A malicious web page can bypass the browser-to-localhost boundary b...

Security Bulletin: IBM MQ Appliance is affected by an integer overflow vulnerability (CVE-2026-11376)

Summary IBM MQ Appliance has addressed an integer overflow vulnerability that could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code when processing subscription requests with crafted buffer size values. Vulnerability Details CVEID:CVE-2026-11376...

Security Bulletin: IBM Verify Directory is affected by multiple vulnerabilities (CVE-2026-8639, CVE-2026-8640, CVE-2026-8642, CVE-2026-8860)

Summary Multiple vulnerabilities have been addressed in IBM Verify Directory in an update. Vulnerability Details CVEID:CVE-2026-8642 DESCRIPTION: IBM Security Verify Directory Web Application exposes debug endpoints that disclose system information including server versions and session identifier...

EUVD-2026-109059

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket in goobi-viewer-core accepts download requests from unauthenticated users...

CVE-2026-93630 Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra host. DefangFilter and the OWASP ActionAttributePolicy compare the form-action hostname with the...

Security Bulletin:Vulnerability in jetty-http-12.1.10.jar may affect IBM Infosphere Change Data Capture (CVE-2026-19203)

Summary A security vulnerability has been identified in jetty-http-12.1.10.jar, Jetty module for handling HTTP protocol logic, including requests, responses, and connection management. jetty-http is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the...

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit...

scanless

⚠️ I am no longer maintaining scanless as of August 2023. ⚠️ scanless This is a Python command-line utility and library for using websites that can perform port scans on your behalf. Supported Online Port Scanners ipfingerprints spiderip standingtech viewdns yougetsignal Install Do it up: $ pip...

isf

Industrial Exploitation Framework ISFIndustrial Exploitation Framework is a exploitation framework based on Python, it's similar to metasploit framework. ISF is based on open source project routersploit. Read this in other languages:English, 简体中文, Disclaimer Usage of ISF for attacking targets...

CVE-2026-110491

A flaw was found in Kiloview E3. An unauthenticated remote attacker can cause a Denial of Service DoS by sending malformed or incomplete requests to the Open Network Video Interface Forum ONVIF service. Successful exploitation renders the service unresponsive to new connections, temporarily...

EUVD-2026-108547

The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be...