EUVD-2026-3066

Malicious code in lusha-micro-app-messages npm...

MAL-2026-293 Malicious code in lusha-micro-app-messages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2763ac2e60a783720a4825cd416a2c3e991ab820c9a11c72d809c5162eb822 The package lusha-micro-app-messages was found to contain malicious code. Source: ghsa-malware...

PT-2026-3261

Name of the Vulnerable Software and Affected Versions Dive versions prior to 0.13.0 Description Dive is an open-source MCP Host Desktop Application that integrates with function-calling LLMs. A crafted deeplink can install an attacker-controlled MCP server configuration without sufficient user...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000577)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000577 advisory. mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service page tainting via a...

Markdownify security vulnerabilities

Markdownify is a minimal Markdown editor desktop application built using Electron by Amit Merchant as a personal development project. Version 1.2.0 of Markdownify contains a security vulnerability; this vulnerability stems from stored cross-site scripting in markdown files, which could lead to...

PT-2026-3265

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's installed apps...

CVE-2021-47815 Nsauditor 3.2.3 - Denial of Service (PoC)

Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can paste a large buffer of 256 repeated characters into the 'Key' field to trigger an application crash...

CVE-2021-47793

Telegram Desktop 2.9.2 is affected by a Denial of Service vulnerability. An attacker can crash the app by pasting an oversized message payload (a 9,000,000‑byte buffer) into the messaging interface. The vulnerability is cited as CVE-2021-47793. Connected sources indicate PoC availability (e.g., E...

CVE-2026-21914

creationtimestamp| type| source ---|---|--- 2026-01-15 21:50:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcikvobwvp2x 2026-01-15 22:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mcilho7pgq2m 2026-01-15 22:12:38+00:00| seen|...

CVE-2023-7334 Changjetong T+ <= 16.x GetStoreWarehouseByStore Deserialization RCE

Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind.PriorityLevel,AppCode.ashx?method=GetStoreWarehouseByStore...

CVE-2021-47777

creationtimestamp| type| source ---|---|--- 2026-01-15 18:32:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mci7tdc7xj2x...

CVE-2021-47819

creationtimestamp| type| source ---|---|--- 2026-01-15 17:59:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mci5y6iq4r2y...

CVE-2021-47784 Cyberfox Web Browser 52.9.1 - Denial of Service (PoC)

Cyberfox Web Browser 52.9.1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the search bar with excessive data. Attackers can generate a 9,000,000 byte payload and paste it into the search bar to trigger an application crash...

CVE-2025-14317

In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a loyaltyGuestId parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 Android and 7.4.1 iOS...

CVE-2026-22265: Improper Neutralization of Special Elements used in an OS Command

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003293)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003293 advisory. The kernel in Android before 2016-08-05 on Nexus 7 2013 devices allows attackers to gain privileges via a crafted application, aka internal bug 28522518. Tenable has...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002998 advisory. kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain...

CVE-2025-66292: Improper Limitation of a Pathname to a Restricted Directory

DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002743)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002743 advisory. The kernel in Android before 2016-08-05 on Nexus 7 2013 devices allows attackers to gain privileges via a crafted application, aka internal bug 28522518. Tenable has...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002805)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002805 advisory. The bnepaddconnection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local use...