Veridium SprintWork 安全漏洞

Veridium SprintWork is a web blocking software developed by Veridium Corporation. Version 2.3.1 of Veridium SprintWork contains a security vulnerability. This vulnerability stems from insecure permissions for files, services, and folders on Windows systems, which may lead to an increase in local...

RockyLinux 9 : fontforge (RLSA-2026:2039)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2039 advisory. fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing CVE-2025-15279 fontforge: FontForge: Remote Code Execution...

Fedora 43 : libgit2 (2026-c0124f91bf)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c0124f91bf advisory. Update to version 1.9.2. Release notes: https://github.com/libgit2/libgit2/releases/tag/v1.9.2 Tenable has extracted the preceding description block directly...

WordPress Advanced Country Blocker plugin <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key vulnerability

Unauthenticated Authorization Bypass via Insecure Default Secret Key vulnerability discovered by Hector Flores in WordPress Plugin Advanced Country Blocker versions = 2.3.1...

CVE-2020-37170 TapinRadio 2.12.3 - 'address' Denial of Service

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy address configuration that allows local attackers to crash the application. Attackers can overwrite the address field with 3000 bytes of arbitrary data to trigger an application crash and prevent normal program...

CVE-2020-37170 TapinRadio 2.12.3 - 'address' Denial of Service

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy address configuration that allows local attackers to crash the application. Attackers can overwrite the address field with 3000 bytes of arbitrary data to trigger an application crash and prevent normal program...

CVE-2020-37170

TapinRadio 2.12.3 is affected by a local, denial-of-service vulnerability in the application proxy address configuration. The issue arises when an attacker overwrites the address field with 3000 bytes of arbitrary data, causing the application to crash and fail normal operation. Affected componen...

CVE-2026-25803 3DP-MANAGER Uses Hard-coded Credentials

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials admin/admin upon the first initialization. Attackers with network access to the application's login interface can gain full...

CVE-2026-25762

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service DoS vulnerability exists in the multipart file handling logic of @adonisjs/bodyparser. When processing file uploads, the multipart parser may accumulate an unbounded amount of data in...

CVE-2026-25635

creationtimestamp| type| source ---|---|--- 2026-02-06 21:21:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tiv42a624 2026-02-06 21:21:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7tjlp4xm2g 2026-02-06 21:57:23+00:00| seen|...

EUVD-2026-5566

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...

CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

NiceGUI is a Python-based UI framework. The ui.markdown component uses the markdown2 library to convert markdown content to HTML, which is then rendered via innerHTML. By default, markdown2 allows raw HTML to pass through unchanged. This means that if an application renders user-controlled conten...

EUVD-2026-5568

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOADDIR / file.name. Malicious filenames containing ../ sequences allow attackers to...

CVE-2026-25634

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPixel stack buffers overlap in CIccTagMultiProcessElement::Apply int IccTagMPE.cpp. This vulnerability is fixed in 2.3.1....

CVE-2026-25643

creationtimestamp| type| source ---|---|--- 2026-02-06 20:17:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7pxyllun25 2026-02-06 20:18:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me7pz64gzu2v 2026-02-06 20:19:21+00:00| seen|...

OESA-2026-1330 assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fixes: A vulnerability was found in Open...

RHSA-2026:2128 Red Hat Security Advisory: python3 security update

Bulletin has no description...

RHSA-2026:2090 Red Hat Security Advisory: python3.12-wheel security update

Bulletin has no description...

RLSA-2026:2090 Important: python3.12-wheel security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

EUVD-2026-5650

The Code Snippets plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.4. This is due to missing nonce validation on the cloud snippet download and update actions in the CloudSearchListTable class. This makes it possible for unauthenticated...