CVE-2026-8718

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

CVE-2026-8718

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

CVE-2026-8718 Out-of-bounds write in DTLS peer Connection ID getsockopt (`TLS_DTLS_PEER_CID_VALUE`) in Zephyr net sockets/TLS

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

CVE-2026-72915

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

CVE-2026-73033

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-72915 Mastodon: Personally-identifying information disclosure due to incorrect access control validation

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

CVE-2026-72915

CVE-2026-72915 affects Mastodon versions 4.6.0-beta.1 through 4.6.4 and 4.7.0-beta.1, where a logged-in local user could access PII of another local user via the show action in app/controllers/admin/collections_controller.rb. The vulnerability stems from the controller using the general collectio...

EUVD-2026-55838

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

pt-identity__AWSGoat

AWSGoat : A Damn Vulnerable AWS Infrastructure !1https://u...

CVE-2026-18617 Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod

A flaw was found in the Data Science Pipelines Operator DSPO. A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name DSN string. By manipulating these parameters, an attack...

CVE-2025-15683

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation faul...

CVE-2026-73033

CVE-2026-73033 affects the Sucuri Security WordPress plugin up to version 2.7.3. A path traversal flaw exists in the pageIntegritySubmission() function (src/integrity.lib.php) that lets authenticated administrators delete arbitrary files by supplying directory traversal sequences via the sucurisc...

CVE-2026-73033

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

EUVD-2026-55803

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

CVE-2026-73033 Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...

Malicious code in plp-contract (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78e1b9f0edcbb33baf6d6ee4137978c45f940943f58a3648970b48eb5fef209d This package intentionally depends on a malicious package. This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other...

Malicious code in neutrl-contracts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0a6030f2cc65968de85749a2fafe2380bbb44fdc7db473763c5a82af5d79bc4 This package intentionally depends on a malicious package. This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other...

Malicious code in neutrl-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f31badf901e75b93290ed22337225d71d1d3e97f2fb7aebd4fcffb4a1ad2bf0f This campaign exfiltrates sensitive environment variables, SSH keys, dotenv files and other credentials. The malicious code is hidden in a dependency package...

Security Bulletin: IBM HTTP Server shipped with IBM OpenPages is affected by multiple vulnerabilities due to the included Apache HTTP Server

Summary IBM HTTP Server used by IBM WebSphere Application Server, is shipped as a supporting program of IBM OpenPages. Information about multiple vulnerabilities affecting IBM HTTP Server has been published in a security bulletin. These products have addressed the applicable CVEs. For a complete...

CVE-2025-15683

TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation faul...