PT-2026-5731

Name of the Vulnerable Software and Affected Versions SignalK Server versions prior to 2.20.3 Description SignalK Server contains a path traversal issue in the applicationData API. Authenticated users on Windows systems can potentially read, write, and list arbitrary files and directories on the...

CVE-2023-54343

QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path parameter manipulation. Attackers can exploit the vulnerability to execute persistent cross-site scripting attacks, potentially leading t...

CVE-2023-54343 QWE DL 2.0.1 Persistent XSS Vulnerability via Path Parameter

QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path parameter manipulation. Attackers can exploit the vulnerability to execute persistent cross-site scripting attacks, potentially leading t...

EUVD-2023-60536

QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path parameter manipulation. Attackers can exploit the vulnerability to execute persistent cross-site scripting attacks, potentially leading t...

CVE-2023-54343

QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to inject malicious script code through path parameter manipulation. Attackers can exploit the vulnerability to execute persistent cross-site scripting attacks, potentially leading t...

CVE-2022-50952 Banco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name Input

Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Name Profile input. Attackers can inject malicious script code through a POST request that executes on application review without user interaction...

CVE-2022-50952 Banco Guayaquil 8.0.0 Mobile iOS Cross-Site Scripting via Profile Name Input

Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Name Profile input. Attackers can inject malicious script code through a POST request that executes on application review without user interaction...

Exploit for CVE-2023-39848

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the improper versification of user identify in comment posting feature. An attacker can exploit this vulnerability by impersonating a registered user, potentially leading to unauthoriz...

CVE-2026-1686

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cstemodules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is possible to initiate the attack remotely. The...

CVE-2026-1686

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cstemodules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is possible to initiate the attack remotely. The...

Ubuntu: Security Advisory (USN-7983-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-71003

creationtimestamp| type| source ---|---|--- 2026-01-29 21:34:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdlqirvw7o2r 2026-01-29 21:34:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdlqj4ouab27...

CVE-2020-37000

creationtimestamp| type| source ---|---|--- 2026-01-29 18:20:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdlfpenzch2g...

CVE-2026-1594

creationtimestamp| type| source ---|---|--- 2026-01-29 18:09:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdlf3asnx426...

CVE-2025-26790

creationtimestamp| type| source ---|---|--- 2026-01-29 16:15:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mdl6omhgqv2j...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the flow.scatter function. An attacker can cause the application to become unresponsive or crash by submitting out-of-bound indexes. Remediation There is no fixed version for...

Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.rundebug=..., so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:weba...

GHSA-VG9H-JX4V-CWX2 Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.rundebug=..., so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:weba...

CVE-2026-25047

creationtimestamp| type| source ---|---|--- 2026-01-29 10:32:43+00:00| published-proof-of-concept| https://github.com/sharpred/deepHas/security/advisories/GHSA-2733-6c58-pf27 2026-01-29 23:33:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdlx6pldxr2n 2026-04-30 07:21:10+00:00|...