CVE-2026-98297

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when network transmission requests are queued while the Bluetooth device is being shut down and its background workqueue is draining. A local attacker could exploit this vulnerability by sending data through...

CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...

fragattacks

FragAttacks: Fragmentation & Aggregation Attacks 1. Introduzione Questo repository contiene il tool FragAttacks. Può testare client Wi-Fi e punti di accesso per attacchi di fr ammentazione e ag gregazione. Queste vulnerabilità riguardano tutte le reti Wi-Fi protette. Per maggiori informazioni su...

awesome-shodan-queries

Impresionantes Consultas de Búsqueda de Shodan Con el tiempo, he recolectado una variedad de consultas de búsqueda interesantes, divertidas y deprimentes para usar en Shodan, el literal motor de búsqueda de internet. Algunas devuelven resultados que provocan vergüenza ajena, mientras que otras...

PT-2026-110139

Name of the Vulnerable Software and Affected Versions Speedtest Tracker versions prior to 1.15.1 Description An IP allowlist bypass allows unauthenticated remote attackers to evade ALLOWED IPS and Prometheus allowlists. This occurs because the bootstrap/app.php file trusts every peer as a proxy,...

PT-2026-110073

Name of the Vulnerable Software and Affected Versions ag2ai ag2 versions prior to 0.13.5 Description A path traversal issue exists in the UserProxyAgent component. The problem occurs within the os.path.join function when processing the filename argument, allowing a remote attacker to manipulate...

PT-2026-110100

Name of the Vulnerable Software and Affected Versions InstantSoft icms2 versions prior to 2.18.2 Description An issue exists in the Billing Module within the validatePaypalOrder function located in the system/controllers/billing/actions/paypal.php file. A remote attacker can manipulate the bid/si...

CVE-2026-108772: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/downloadcache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched...

CVE-2026-108578: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-108863: Missing Authentication for Critical Function

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /configdump endpoint to read configured LLM provider API...

PT-2026-110103

Name of the Vulnerable Software and Affected Versions Xinhu Rainrock RockOA versions prior to 2.7.7 Description A remote SQL injection exists within the Openkqj Action component. The issue occurs in the kqjcmdModel::returnchuli function located in the webmain/task/openapi/openkqjAction.php file. ...

PT-2026-110000

Name of the Vulnerable Software and Affected Versions Studio-Saelix Sencho versions prior to 0.97.1 Description An issue exists in the Add Remote Node API Endpoint component within the isValidRemoteUrl function of the backend/src/utils/validation.ts file. An authenticated user with node-managemen...

CVE-2026-108770: Server-Side Request Forgery (SSRF)

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

PT-2026-110098

Name of the Vulnerable Software and Affected Versions InstantSoft icms2 versions prior to 2.18.2 Description A remote cross site scripting issue exists within the Private Message Handler component. The problem occurs in the index function located in the...

PT-2026-110106

Name of the Vulnerable Software and Affected Versions BerriAI LiteLLM versions prior to 1.96.0 Description An authorization bypass exists in the Spend Tracking component within the ui view session spend logs function of the litellm/proxy/spend tracking/spend management endpoints.py file. A remote...

CVE-2026-108768: Allocation of Resources Without Limits or Throttling

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108682: Improper Resource Shutdown or Release

A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the publi...

CVE-2026-108748: Missing Release of Memory after Effective Lifetime

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108736: Use of Less Trusted Source

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...