CVE-2026-51843: Undefined Security Weakness

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter...

CVE-2026-12620: Exposure of Sensitive Information to an Unauthorized Actor

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0...

CVE-2026-56142: Improperly Controlled Modification of Dynamically-Determined Object Attributes

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible...

CVE-2026-53915: External Control of File Name or Path

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration...

CVE-2026-41156: Use After Free

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario. A shared resource memory page managed by a CPU thread of control driver and accessed by a GPU thread of control Firmware can caus...

CVE-2026-50034: Cleartext Transmission of Sensitive Information

An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values...

CVE-2026-56132: Incorrect Synchronization

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers...

CVE-2026-51844: Undefined Security Weakness

Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter...

CVE-2026-52866: Missing Authorization

An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection...

TCP Port Scanner

Scan TCP ports on one or more hosts using parallel connect probes. !/usr/bin/env python3 -- coding: utf-8 -- """Parallel TCP connect port scanner for authorized engagements.""" from future import annotations import ipaddress import socket from concurrent.futures import ThreadPoolExecutor,...

CVE-2026-47633: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network...

CVE-2026-42488: Undefined Security Weakness

Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache...

CVE-2026-42487: Undefined Security Weakness

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model via XENDOMCTLioportmapping, and hence the linked list used may changed at any time. Traversal of those lists while handling guest I/O port accesses therefore needs...

@aegis-scan/core (>=0.18.1, <=0.19.0), @aegis-scan/reporters (>=0.18.4, <=0.19.0) +453 more potentially affected by CVE-2026-9697 via undici (>=7.24.0, <=7.27.2)

undici NPM version =7.24.0, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.1.8, =0.1.7, =21.2.4, =21.2.4, =2.0.0-beta.3, =0.1.0, =0.18.0, =0.1.0, =0.4.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-9697 Source advisory: SNYK:JS-UNDICI-17372609...

CVE-2026-53872

picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to read arbitrary server files by chaining io.FileIO and urllib.request.urlopen. Attackers can bypass RCE-focused blocklists to exfiltrate sensitive data like /etc/passwd to externa...

EUVD-2026-37741

picklescan before 1.0.3 contains a scanning bypass vulnerability in the scanpytorch function that allows attackers to embed malicious magic numbers via dynamic eval using the reduce trick. Attackers can craft malicious PyTorch payloads that evade picklescan detection while remaining executable,...

EUVD-2025-210270

picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbo...

CVE-2025-71325 picklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic Flaw

picklescan before 0.0.27 contains a parsing logic error in the listglobals function when handling STACKGLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigg...

CVE-2025-69148: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Quirky = 1.23 versions...

CVE-2026-12565: Improper Limitation of a Pathname to a Restricted Directory

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools e.g. GNU tar which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extractio...