14939 matches found
GHSA-P9J2-GV94-2WF4
creationtimestamp| type| source ---|---|--- 2026-08-10 19:39:37+00:00| seen| https://gist.github.com/klemmanton-lgtm/8b54bdd2fe9905dc89b9c8ccf42f5fc4 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/4a24aedae8017b5aebed0300d07c7ee9 2026-08-17 10:21:36+00:00| seen|...
CVE-2021-34516
creationtimestamp| type| source ---|---|--- 2026-08-10 19:06:31+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3msqsaonhhh2d...
CVE-2026-49007
creationtimestamp| type| source ---|---|--- 2026-08-10 17:59:21+00:00| seen| https://gist.github.com/digitalgangst4r/e56a1a1494c1ac4d81a87fddc57a712a...
CVE-2026-6373 Sensitive Data Exposure in Zyxel WAH7601 Router
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...
EUVD-2026-55620
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...
What SecureIQLab Cloud WAAP 5.0 means for your application security
You cannot verify a vendor’s security claims from their own datasheet, including ours. That is why independent validation matters. In our recent guide to the best WAAP solutions Best WAAP Solutions 2026: Enterprise Buyer Guide, we argued that every serious shortlist should include independent...
Imperva Customers Protected Against Novel HTTP Desync Attacks
TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently...
DEBIAN-CVE-2026-67422
pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde, betterem, and magiclink use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways,...
CVE-2026-46581
In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...
EUVD-2026-53310
Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $POST'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='$username' and password='$password' limit 1". The username value is...
EUVD-2026-52790
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...
CVE-2026-18610
CVE-2026-18610 affects NewType WebEIP up to v3.0, impacting an unknown part of the file /EIP_Com_FileList.aspx. The issue enables improper authentication and can be exploited remotely; the exploit is public. Vendor did not respond to disclosure. No remediation details are provided in the availabl...
offensive-security-labs
Offensive Security Labs A collection of hands-on offensive cy...
PT-2026-66860
Name of the Vulnerable Software and Affected Versions Modern Loan Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, at the '/admin/delete group.php' endpoint via the id...
CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...
CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...
CVE-2026-18361
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
CVE-2026-16971
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks...