SiYuan <= v3.6.1 - Path Traversal

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under /appearance/filepath. Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server...

MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

CVE-2026-47056

creationtimestamp| type| source ---|---|--- 2026-07-21 22:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6t6ksyuu2s 2026-07-22 16:15:08+00:00| seen| https://www.ncsc.nl/alerts/update-oracle-fusion-middleware-direct-vanwege-kritieke-kwetsbaarheden 2026-07-23...

CVE-2026-57251

Foxit CVE-2026-57251 affects Foxit PDF Editor/Reader during the cloud-like construction phase when opening a PDF. The issue is an out-of-bounds access caused by missing upper bounds checks in the cloud appearance logic, leading to application crashes. The CVSS v3.1 metrics assign a base score of ...

CVE-2026-57251 Foxit PDF Editor/Reader Cloud Appearance Buffer Overflow Vulnerability

The application opens a PDF, but the cloud-like appearance of the construction process lacks proper setting of an upper limit and consistency checks. Out-of-bounds access to the underlying array is exposed, ultimately leading to a crash of the application...

CVE-2026-14778

creationtimestamp| type| source ---|---|--- 2026-07-06 04:35:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpxbbsa4hv26 2026-07-07 15:56:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq2xs6df7a2f...

CVE-2024-30151

creationtimestamp| type| source ---|---|--- 2026-05-07 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mlbxnwxsce2u...

Malicious code in bytedark (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b1b29d53129e34fa2f09eacd9218f1bf87711e4a88587ee9c5f4453cfb6974ac Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-3086 Malicious code in bytedai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6453b603ad8bfd1ff4463c1bd86e1930757b08239ec949b01fbc95ca0c5486a6 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in bytedfaas (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec7e2decd402442fba2d4ebd7637b596a33ef132120ffe4f3a8b5d2d6ce8475e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-40472

creationtimestamp| type| source ---|---|--- 2026-04-23 19:39:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6rawsxnu2n 2026-04-24 15:22:14+00:00| seen| Telegram/9MQPqn6NQB4yNQwBhEjQmfZAQamilmjjvNDDQhjtzrN-0VE...

Lexmark International X1185 Improper Privilege Management (CVE-2006-0577)

Lexmark X1185 printer allows local users to gain SYSTEM privileges by navigating to the Appearance dialog and selecting the Additional styles skins are available on the Lexmark web site option, which launches a web browser that is running with SYSTEM privileges. This plugin only works with...

[SECURITY] Fedora 44 Update: kde-gtk-config-6.6.4-1.fc44

This is a System Settings configuration module for configuring the appearance of GTK apps in KDE...

Malicious Package

Overview dev-log-core is a malicious package. This package is the part of North Korea’s Contagious Interview Campaign and contains malicious payload, weaponised to steal credentials, wallets, and enable remote access to affected systems. The package attempts to mimic a legitimate package and the...

CVE-2026-35181

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck, removing...

CVE-2026-35181

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck, removing...

Cross-site Request Forgery (CSRF)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the admin/playerUpdate.json.php process. An attacker can modify the video player appearance across the platform by tricking an...

CVE-2026-3776

The application does not validate the presence of required appearance AP data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a...

EUVD-2026-17753

The application does not validate the presence of required appearance AP data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a...

CVE-2026-3776

The application does not validate the presence of required appearance AP data before accessing stamp annotation resources. When a PDF contains a stamp annotation missing its AP entry, the code continues to dereference the associated object without a prior null or validity check, which allows a...