Content Management System Command Injection Vulnerabilities

Content Management System is a lightweight content management system developed by DefaultFunction’s individual developer. Version 1.0 of Content Management System has a command injection vulnerability. This vulnerability stems from improper handling of the ‘host’ parameter in the ‘admin/tools.php...

Security update for net-tools (moderate)

openSUSE security update: security update for net-tools ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20437-1 Rating: moderate References: bsc1243581 bsc1248410 bsc1248687 bsc142461 bsc430864 bsc544339 Cross-References: CVE-2025-46836 CVSS scores:...

CVE-2026-0688: Server-Side Request Forgery (SSRF)

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the 'Tools::read' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations...

Regular Expression Denial of Service (ReDoS)

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

CVE-2026-34536

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, a crafted ICC profile can trigger a stack overflow SO in SIccCalcOp::ArgsUsed. The issue is observable under AddressSanitizer as a stack-overflow when iccApplyProfiles processes ...

algokit (>=2.7.0, <=2.10.0), cicd-tools (1.0.0) +12 more potentially affected by CVE-2026-34730 via copier (>=9.0.1, <=9.11.3)

copier PYPI version =9.0.1, =2.7.0, =1.6.0b0, =0.40.0, =0.1.58, =1.0.0, =4.3.4, =4.3.4, =5.0.0b2, =4.3.4, =4.3.4, =2.9.1, =2.51.0 Source cves: CVE-2026-34730 Source advisory: GHSA-HGJQ-P8CR-GG4H...

algokit (>=2.7.0, <=2.10.0), cicd-tools (1.0.0) +12 more potentially affected by CVE-2026-34730 via copier (>=9.0.1, <=9.11.3)

copier PYPI version =9.0.1, =2.7.0, =1.6.0b0, =0.40.0, =0.1.58, =1.0.0, =4.3.4, =4.3.4, =5.0.0b2, =4.3.4, =4.3.4, =2.9.1, =2.51.0 Source cves: CVE-2026-34730 Source advisory: OSV:GHSA-HGJQ-P8CR-GG4H...

algokit (>=2.7.0, <=2.10.0), cicd-tools (1.0.0) +12 more potentially affected by CVE-2026-34726 via copier (>=9.0.1, <=9.11.3)

copier PYPI version =9.0.1, =2.7.0, =1.6.0b0, =0.40.0, =0.1.58, =1.0.0, =4.3.4, =4.3.4, =5.0.0b2, =4.3.4, =4.3.4, =2.9.1, =2.51.0 Source cves: CVE-2026-34726 Source advisory: OSV:GHSA-85V3-4M8G-HRH6...

CVE-2026-34163

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP Model Context Protocol tools endpoints /api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool accept a user-supplied URL parameter and make server-side HTTP requests to it without validating whether the...

CVE-2026-34162

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint /api/core/app/httpTools/runTool is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers,...

CVE-2026-30291

An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

Ransomware Groups Exploit Legit IT Tools to Bypass Antivirus

New research from Seqrite explains the 'dual-use dilemma,' where ransomware attackers repurpose legitimate IT tools like IOBit Unlocker…...

3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)

For years, cybersecurity has followed a familiar model: block malware, stop the attack. Now, attackers are moving on to what’s next. Threat actors now use malware less frequently in favor of what’s already inside your environment, including abusing trusted tools, native binaries, and legitimate...

MAL-2026-2327 Malicious code in kube-health-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4d36d5ed9b1bc15c12e89f48c1228a4f6e3aebe558a67d535655e280b25b4440 During import, the code download and starts remote executable that later connects to a C2 server, likely establishing a reverse tunnel. After executing the...

Malicious code in kube-health-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4d36d5ed9b1bc15c12e89f48c1228a4f6e3aebe558a67d535655e280b25b4440 During import, the code download and starts remote executable that later connects to a C2 server, likely establishing a reverse tunnel. After executing the...

[SECURITY] Fedora 42 Update: xen-4.19.5-1.fc42

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 43 Update: gst-devtools-1.26.11-1.fc43

Development and debugging tools for GStreamer...

CVE-2026-30291

An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

CVE-2026-30291

An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure...

PT-2026-38108

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 148.0.7778.96 Description Insufficient data validation in DevTools allows a remote attacker to bypass navigation restrictions through the use of a crafted HTML page. Recommendations Update to version...