CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

CVE-2026-77818

CVE-2026-77818 is a reflected HTML injection vulnerability in Yordam Informatics' Library Information and Document Automation Program (affects versions from v22.1 before v22.2 ), exploitable via form hijacking during web page generation. The vulnerability allows content spoofing and is rated CVSS...

Mirth-Connect-CVE-2023-43208

CVE-2023-43208: Unauthenticated Remote Code Execution RCE in NextGen Mirth Connect This exploit leverages a critical deserialization vulnerability within Mirth Connect's XStream engine. It stems from an incomplete patch for CVE-2023-37679, enabling unauthenticated arbitrary code execution across...

Vulnerabilities in Wibu Systems CodeMeter Runtime Affect Multiple SICK Products

Several vulnerabilities in the Wibu Systems CodeMeter Runtime affect the SICK products Sentio Creator, Sentio Compose, Safety Designer, Stream Editor, PLB and multiple SICK Industrial PCs APU0G00, APU0G50, APU0G03, APU3F00, APU4600, APU8G00 and APU8G20, which ship with CodeMeter Runtime as part o...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Missing Release of Resource after Effective Lifetime and Improper Certificate Validation due to HttpClient (CVE-2026-64607 & CVE-2026-71290)

Summary IBM App Connect Enterprise runtime is vulnerable to Missing Release of Resource after Effective Lifetime and Improper Certificate Validation due to HttpClient. Vulnerability Details CVEID:CVE-2026-64607 DESCRIPTION: HttpClient based on the classic i/o model fails to correctly release the...

Authentication Bypass Using an Alternate Path or Channel

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via malformed URLs in the fourOhFour router in lib/four-oh-four.js. An attacker can reach an encapsulated not-found handler and...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net/sched: Fixed a issue where partial COW operations by pedit led to corruption of the page cache. tcfpeditact calculates the COW range for skbensurewritable once before the key loop, using tcfpoffmaxhint. However, this hint...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fixed a use-after-free in bondxmitbroadcast. bondxmitbroadcast reuses the original skb for the last slave determined by bondislastslave and clones it for others. Concurrent slave enslave/release operations may mutat...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: eventpoll: Fixed an UAF Use-After-Free in epremovestruct eventpoll, struct file. epremove via epremovefile clears file-fep under file-flock, but then continues using @file within the critical section isfileepoll, hlistdelrcu,...

PhoneSploit-Pro v2.3

PhoneSploit Pro The Swiss Army knife for Android. An all-in-one hacking tool written in Python to remotely take over Android devices using ADB, scrcpy, Nmap, and Metasploit-Framework. Table of contents Overview Screenshots Features Requirements Installing dependencies Getting started Device setup...

CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

Exploit for CVE-2026-82876

CVE-2026-82876 — Phison S11 SSD Firmware Signature Verificatio...

EUVD-2026-71017

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594 Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

CVE-2026-85594

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider . A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its ...

strix v1.6.1

Strix The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities. !TIP New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilit...

CVE-2026-84045

The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking...