CVE-2026-22247

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5...

CVE-2026-21893

Summary of CVE-2026-21893 (n8n): A command injection vulnerability existed in n8n’s community package installation functionality from versions 0.187.0 up to before 1.120.3, allowing authenticated users with administrative permissions to execute arbitrary system commands on the n8n host under cert...

DEBIAN-CVE-2026-23059

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Sanitize payload size to prevent member overflow In qla27xxcopyfpinpkt and qla27xxcopymultiplepkt, the framesize reported by firmware is used to calculate the copy length into item-iocb. However, the iocb member is...

EUVD-2026-5361

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patch...

EUVD-2026-5385

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5...

Malicious code in mdp-client-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bae22cc58ac4c2a2b449514ef62c82fde3dd2d6d0d5697b3689f16c8583e62b The package mdp-client-web was found to contain malicious code. Source: ghsa-malware 070c26f2080c516dd8c197674dcc76a911d4dfb62242027e1d50a04c4536f0b2...

EUVD-2026-5416

n8n is an open source workflow automation platform. Prior to versions 1.123.12 and 2.4.0, when workflows process uploaded files and transfer them to remote servers via the SSH node without validating their metadata the vulnerability can lead to files being written to unintended locations on those...

CVE-2025-8461

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Seres Software syWEB allows Reflected XSS.This issue affects syWEB: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

BELL-CVE-2026-23028

Bulletin has no description...

BELL-CVE-2025-71187

Bulletin has no description...

CVE-2026-22875

Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life EOL, are affected by the...

CVE-2026-22875

Movable Type contains a stored cross-site scripting vulnerability in Export Sites. If crafted input is stored by an attacker, arbitrary script may be executed on a logged-in user's web browser. Note that Movable Type 7 series and 8.4 series, which are End-of-Life EOL, are affected by the...

MAL-2026-723 Malicious code in http-emailjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9d03c741837fca8f8630f52d108b904dff1e056ff9b3bee73df663f691a59f The package http-emailjs was found to contain malicious code. Source: ghsa-malware cd9f06aa02e0e2ed77b3cedfb2e499b9f73530f95231f0fdc8dbeecc0bf2222a A...

CVE-2025-6592

Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0...

CVE-2025-6595

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MultimediaViewer.This issue affects MultimediaViewer: from before 1.39.13, 1.42.7, 1.43.2, 1.44.0...

CVE-2026-24932

The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication to perform a Man-in-the-Middle MitM attack, whi...

CVE-2026-24935

A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle MitM attacker can intercept or redirect the NAT tunnel establishment. This could...

Hancom Office 安全漏洞

Hancom Office is a mobile office application developed by Hancom Corporation in South Korea. This program supports the viewing and editing of documents in various formats. There is a security vulnerability in Hancom Office, which stems from type confusion and may lead to file content injection. T...

PT-2026-6009

Name of the Vulnerable Software and Affected Versions Autodesk 3ds Max affected versions not specified Description A specially designed RGB file, when processed by Autodesk 3ds Max, can lead to a memory corruption issue. An attacker could potentially use this to run code without authorization...

PT-2026-6088

Name of the Vulnerable Software and Affected Versions KnoxGuardManager versions prior to SMR Feb-2026 Release 1 Description A flaw exists in KnoxGuardManager that allows local attackers to bypass the application's persistence configuration due to improper authorization. Recommendations Update...