CVE-2026-6002: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross-Site Scripting XSS. This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2...

CVE-2026-3953: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gosoft Software Industry and Trade Ltd. Co. Proticaret E-Commerce allows Cross-Site Scripting XSS, Reflected XSS. This issue affects Proticaret E-Commerce: from v5.0.0 before V 6.0.1767.1383...

CVE-2026-33811: Double Free

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

CVE-2026-33814: Loop with Unreachable Exit Condition

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CVE-2026-39823: Undefined Security Weakness

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: trivy, flux-fips, src-fingerprint, syft-fips, kubevela, pulumi-language-dotnet, flux-source-controller-fips, kots, chainloop-cli-fips, zot, gitlab-rails-ce, commercial-chainloop-cli, cerbos, flux-source-controller, syft, skaffold-fips, redpanda-console,...

CVE-1999-0497

creationtimestamp| type| source ---|---|--- 2026-05-06 13:28:27+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ftp/ftpanonymous.rb 2026-09-08 06:47:25+00:00| seen|...

github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload

A denial-of-service vulnerability in github.com/sirupsen/logrus occurs when Entry.Writer processes a single-line payload larger than 64KB with no newline characters. Due to a limitation in Go’s internal bufio.Scanner, the read operation fails with a “token too long” error, causing the underlying...

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

CVE-2026-31431 Checker & Mitigator A simple, safe vulnerabili...

build-magic (>=0.4.1rc0, <=0.5.1rc0), lemur (>=1.1.0, <=1.2.0) +10 more potentially affected by CVE-2026-44405 via paramiko (2.9.2)

paramiko PYPI version 2.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - build-magic =0.4.1rc0, =1.1.0, =0.10.10, =1.0.0, =0.10.4, =0.2.0.1, =0.0.0.dev0, =1.27.0, =1.34.0 - wizardwebssh 1.9.0 Source cves: CVE-2026-444...

CVE-2025-71256: Undefined Security Weakness

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-41066)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-41066 advisory. - lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using...

CVE-2026-44115: Incomplete List of Disallowed Inputs

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime...

CVE-2026-43578: Incomplete List of Disallowed Inputs

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged contex...

CVE-2025-31982: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management SM had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality...

CVE-2026-6860: Allocation of Resources Without Limits or Throttling

A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a server wildcard name, e.g. if the server is configured with a certificate accepting .example.com, any XYZ.example.com where xyz is a valid name can be used...

Linux Distros Unpatched Vulnerability : CVE-2026-43191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Adjust PHY FSM transition to TXEN-to-PLLON for TMDS on DCN35 Why A backport of the change made for DCN401 that addresses an issue where we turn...

Linux Distros Unpatched Vulnerability : CVE-2026-43226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/rds: No shortcut out of RDSCONNERROR RDS connections carry a state rdsconnpath::cpstate and transitions from one state to another and are conditional upon a...

CVE-2026-43114: Use of Incorrect Operator

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapoavx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -...

CVE-2025-52613: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management SM is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access...