PT-2026-72946

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unauthenticated client can trigger a memory leak by sending multiple successful SMB2 NEGOTIATE requests on a single connection before the SESSION SETUP phase. When the connection is i...

SUSE CVE-2026-56862

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

CVE-2026-67366

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

EUVD-2026-58806

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-12363

CVE-2026-12363 : The LoRaWAN Fragmented Data Block Transport service does not validate frag_counter in DATA_FRAGMENT before passing it to the decoder. frag_counter is derived from the payload (frag_index_n & 0x3FFF) and, when 0, causes fragCounter − 1 to underflow, writing out of bounds in the de...

CVE-2026-12363

The LoRaWAN Fragmented Data Block Transport service subsys/lorawan/services/fragtransport.c does not validate the fragment counter in a received DATAFRAGMENT command before forwarding it to the configured decoder. In fragtransportpackagecallback the value fragcounter = hdr-fragindexn & 0x3FFF is...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469

Nozomi Networks Labs identifies a CSRF vulnerability (CWE-352) in the web-based configuration backend of KUNBUS PiCtory v2.16.0. The issue allows a remote unauthenticated attacker to perform state-changing actions within an authenticated operator session by tricking a victim into submitting craft...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

ejpt-mission-framework-poc

eJPT Mission Framework An evidence-backed Markdown workflow f...

GO-2022-0619 vulnerabilities

Vulnerabilities for packages: kubeflow-fips, kubeflow, kube-state-metrics...

GO-2022-1130 vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway, kube-state-metrics, prometheus-pushgateway-fips...

GO-2023-1571 vulnerabilities

Vulnerabilities for packages: wireguard-go, hey, kubeflow-fips, restic, terraform-provider-sendgrid-fips, kubeflow, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, k3d, kube-state-metrics, kubeflow-katib, terraform-provider-sendgrid, gke-gcloud-auth-plugin, go, grpcurl...

GO-2022-0969 vulnerabilities

Vulnerabilities for packages: wireguard-go, hey, kubeflow-fips, terraform-provider-sendgrid-fips, kubeflow, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, k3d, kube-state-metrics, kubeflow-katib, terraform-provider-sendgrid, grpcurl...

GO-2022-1059 vulnerabilities

Vulnerabilities for packages: php-fpmexporter, hey, kubeflow-fips, terraform-provider-sendgrid-fips, kubeflow, dynamic-localpv-provisioner-fips, dynamic-localpv-provisioner, gitleaks, k3d, kube-state-metrics, terraform-provider-sendgrid, vt-cli, grpcurl...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: karpenter, runc, crossplane-provider-aws-s3, terraform-docs, actions-runner-controller, cert-exporter, litestream, cluster-api-ipam-provider-in-cluster, sftpgo-plugin-eventstore, datadog-agent, aws-flb-kinesis, crossplane-provider-aws-ec2, steampipe,...

CVE-2026-67366: Cross-Site Request Forgery (CSRF)

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-57469: Cross-Site Request Forgery (CSRF)

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

PT-2026-72037

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...