Netatalk security vulnerabilities

Netatalk is an open-source software developed by Netatalk Inc. It provides AFP file server functionality for Classic Mac OS and macOS on Unix-like operating systems. Versions 2.0.4 to 4.4.2 of Netatalk contain security vulnerabilities. These vulnerabilities stem from a confusion between UCS-2 typ...

PT-2026-61436

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unprivileged local user can cause a host CPU to pin indefinitely. This occurs when L2TP CMD SESSION GET is issued on L2TP ATTR IFNAME concurrently with L2TP CMD SESSION CREATE and L2T...

F5 Networks BIG-IP : BIG-IP SIP profile vulnerability (K000161023)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.2 / 17.5.1.6 / 21.0.0.2. It is, therefore, affected by a vulnerability as referenced in the K000161023 advisory. When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic...

F5 Networks BIG-IP : BIG-IP HTTP/2 vulnerability (K000159034)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4 / 21.0.0.1. It is, therefore, affected by a vulnerability as referenced in the K000159034 advisory. When an HTTP/2 profile and an iRule containing theHTTP::redirectorHTTP::respondcommand are configured ...

PT-2026-42703

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.4.5 Description The MCP SSE server defaults to an empty secret via the NETWORK AI MCP SECRET environment variable, which causes the isAuthorized function to return true for all requests regardless of whether an...

CVE-2026-48110

creationtimestamp| type| source ---|---|--- 2026-05-20 22:50:48+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-4r3c-5hpg-58qr 2026-06-10 23:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnxsv4ht3726 2026-06-10...

CVE-2026-9139

creationtimestamp| type| source ---|---|--- 2026-05-20 21:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcsf6psua2z 2026-05-21 03:02:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/116610329903528105 2026-06-22 02:01:38+00:00| seen|...

CVE-2026-24217

creationtimestamp| type| source ---|---|--- 2026-05-20 20:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcrn6mexd2i 2026-05-21 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmfd7rb3va2q...

CVE-2026-46378 vulnerabilities

Vulnerabilities for packages: vale...

curl: Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree

Hi all, We've found an issue in lib/easy.c where curleasyduphandle shallow-copies set.priority, so the original and the duplicate end up holding two independent pointer-typed variables that both reference the same heap-allocated Curldataprionode chain. Freeing the chain from one side leaves the...

CVE-2026-35008

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...

CVE-2026-39405 Frappe has Path Transversal via SCORM

Frappe Learning Management System LMS is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1...

CVE-2026-35007

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in singleunit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a maliciou...

CVE-2026-8488

creationtimestamp| type| source ---|---|--- 2026-05-20 19:11:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcmcqwycn2i 2026-05-21 12:25:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmeg2efjkj27 2026-07-23 12:19:38+00:00| seen|...

EUVD-2026-31133

InfoScale CmdServer before 7.4.2 mishandles access control...

CVE-2026-45444 WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6...

CVE-2026-39047

creationtimestamp| type| source ---|---|--- 2026-05-20 17:59:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmcib4y7ky2w 2026-05-20 20:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcozwcu5h2q 2026-07-13 22:00:12+00:00| seen|...

CVE-2025-32750

creationtimestamp| type| source ---|---|--- 2026-05-20 17:56:56+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmci4r6pzr2q 2026-05-20 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcp25o5552e...

CVE-2026-44926

InfoScale CmdServer before 7.4.2 mishandles access control...

WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Joe Bruno, Principal Security Engineer @ Monarx in WordPress Plugin Gift Cards For WooCommerce Pro versions = 4.2.6...