CVE-2026-25656

creationtimestamp| type| source ---|---|--- 2026-02-10 10:31:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3meir2en3ge2h 2026-02-12 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-01 2026-02-17 18:54:30+00:00| seen|...

Malicious code in devtools-webhook-cicd-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 807557cb6ac51aece00eeb28f55b89815176c95172780dcdded46b667f843771 During installation, package installs a script that listens for remote commands and executes them. The script is also added to autostart configuration and...

CVE-2026-23688

SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted...

CVE-2026-23688 Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)

SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted...

CVE-2026-23688 Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)

SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on integrity, confidentiality and availability are not impacted...

[SECURITY] Fedora 43 Update: rust-app-store-connect-0.5.0-6.fc43

Apple App Store Connect API and client...

PT-2026-7469

Name of the Vulnerable Software and Affected Versions ZOLL ePCR IOS application affected versions not specified Description The application displays user-supplied data within a WebView without proper sanitization. Specifically, attacker-controlled strings entered into PCR fields such as run numbe...

PT-2026-7402

Name of the Vulnerable Software and Affected Versions Windows App for Mac affected versions not specified Description A flaw in how the Windows App for Mac handles link resolution before file access, known as 'link following', could allow a local attacker to gain higher privileges. The issue was...

CVE-2026-25925

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...

CVE-2026-25925

PowerDocu (Windows GUI) is vulnerable before version 2.4.0 due to JSON deserialization in Flow/App packages. The app blindly trusts the $type property, allowing an attacker to instantiate arbitrary .NET objects and execute code. This yields high-severity, local, with user interaction required. Fi...

CVE-2026-25925

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...

CVE-2026-25057

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...

CVE-2026-24900

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...

CVE-2026-25057

CVE-2026-25057 affects MarkUs prior to version 2.9.1. Instructors can upload a zip file to create an assignment from an exported configuration, and the zip entry names are used to construct paths for writing files to disk without validating those paths. This can allow arbitrary path usage during ...

CVE-2026-24900

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses//assignments//submissions/htmlcontent accepted a selectfileid parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correct...

NordicTrackExploit

QZCompanionNordictrackTreadmill Companion App of QZ for Nordic...

CVE-2026-0870

MacroHub developed by GIGABYTE has a Local Privilege Escalation vulnerability. Due to the MacroHub application launching external applications with improper privileges, allowing authenticated local attackers to execute arbitrary code with SYSTEM privileges...

ROS-20260209-73-0021

Vulnerability in nextcloud-app-mail caused by failure to take measures to protect web page structure. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

PT-2026-7179

Name of the Vulnerable Software and Affected Versions PowerDocu versions prior to 2.4.0 Description PowerDocu, a Windows GUI executable for technical documentation, has a security issue in its JSON parsing process within Flow or App packages. The application incorrectly trusts the $type property ...

CVE-2026-2152

creationtimestamp| type| source ---|---|--- 2026-02-08 13:30:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116035251770655833 2026-02-08 13:30:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mee25goix22b 2026-02-08 23:43:08+00:00| seen|...