CVE-2026-79079: Improper Neutralization of Special Elements used in an OS Command

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

The vulnerability of the functions raw_client_psk(), raw_server_psk(), raw_cookie_generate(), and raw_stateless_cookie_generate() in the OpenSSL library’s src/ssl/callbacks.rs module allows a hacker to disclose sensitive information or cause service failures.

The vulnerability of the functions rawclientpsk, rawserverpsk, rawcookiegenerate, and rawstatelesscookiegenerate in the OpenSSL library’s src/ssl/callbacks.rs module is related to the execution of operations outside of memory buffers. Exploiting this vulnerability could allow an attacker to...

PT-2026-96225

Name of the Vulnerable Software and Affected Versions Warpgate versions 0.25.0 through 0.27.5 Description The browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity. Instead, it passes ssh options.host and ssh options.port for the...

The vulnerability of the _libssh2_packet_add() function in the src/packet.c component of the SSH2 implementation library Libssh2 allows a attacker to cause a service failure.

The vulnerability of the libssh2packetadd function in the src/packet.c component of the SSH2 protocol implementation library Libssh2 involves executing a loop with an unreachable exit condition. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-79079

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

PT-2026-96287

Name of the Vulnerable Software and Affected Versions CrossWire Xiphos versions prior to 4.3.3 Description A local attacker can execute arbitrary code through the src/main/url.cc and src/gtk/menu popup.c components. Recommendations Update to a version newer than 4.3.2. Restrict access to the...

PT-2026-95908

Name of the Vulnerable Software and Affected Versions Dromara UJCMS versions prior to 12.3.2 Description An improper authorization issue exists in the UserController component. A remote attacker can manipulate the Username variable within the usernameExist function of the...

PT-2026-95898

Name of the Vulnerable Software and Affected Versions olivier-ls PHP-FTS versions prior to 1.1.4 Description An issue exists in the Filter Matching component within the SearchEngine::matchesSingleFilter function located in the src/SearchEngine.php file. Manipulation of this function leads to an...

PT-2026-95973

Name of the Vulnerable Software and Affected Versions 0-Gaurav-0 nexus-mcp affected versions not specified Description Command injection is possible in the nexus reauth MCP tool within the file src/auth/browser.ts. The issue occurs when the url argument is passed to the child process.exec functio...

CVE-2026-94031: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The...

CVE-2026-94049: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function renderslides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be...

CVE-2026-94047: Improper Privilege Management

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of...

Linux Distros Unpatched Vulnerability : CVE-2026-63450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in...

Sensitive Information in Resource Not Removed Before Reuse

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse via the viewInfo operation in...

CVE-2026-63450

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverabl...

DEBIAN-CVE-2026-63450

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverabl...

CVE-2026-63447

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk...

CVE-2026-57228

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-63447

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk...

CVE-2026-57223 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...