CVE-2026-49243

Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their server are vulnerable to this XSS vulnerability that could be used to execute attacker-controlled commands. This issue has been patched in version...

git-dumper

git-dumper 一个从网站转储 git 仓库的工具。 安装 可以通过 pip 轻松安装： pip install git-dumper 使用 usage: git-dumper options URL DIR Dump a git repository from a website. positional arguments: URL url DIR output directory optional arguments: -h, --help show this help message and exit --proxy PROXY use the specified proxy...

EUVD-2026-44813

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding...

WordPress Forminator Forms plugin 1.17.1-1.57.2.0 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability

Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.17.1-1.57.2.0...

CVE-2025-68664

CVE-2025-68664 这一切我想在圣诞节得到的就是你们的秘密：LangGrinch 袭击了 LangChain 核心 CVE-2025-68664 作者：亚尔登·波拉特 Cyata 研究：LangChain 中的 LangGrinch 漏洞 已发布：https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ 昨天，LangChain 发布了一个关于我在 langchain-core 中发现的漏洞的关键警告：CVE-2025-68664 / GHSA-c67j-w6g6-q2cm。...

DEBIAN-CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

EUVD-2026-83612

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

UBUNTU-CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054: Out-of-bounds Write

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-93869

Cotonti through 1.0.0 contains an open redirect vulnerability in the coturlcheck function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect user...

CVE-2026-92597

Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that...

EUVD-2026-79949

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

Astra Linux – Vulnerability in Pypy

In the http.cookiejar.py module of Python, prior to version 3.7.3, the domain validation mechanism was not properly implemented. This vulnerability could allow existing cookies to be sent to the wrong server. Attackers could exploit this flaw by using a server whose hostname contains another vali...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could cause the memory manager to improperly free a pointer that points to attacker-controlled memory, resulting in an assertion error, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox 112, Focus for Android 112, Firefox ESR 102.10, Firefox for...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

Creating a malicious file using cmd/go can result in writing to a file controlled by an attacker, with partial control over the file’s content. The cgo pkg-config: directive in a Go source file provides command-line arguments that are passed to the Go pkg-config command. An attacker can provide a...

CVE-2026-89648

In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in cephparsedeleginos cephparsedeleginos decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with...

CVE-2026-78571

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...

EUVD-2026-42936

Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation...

CVE-2026-44950

fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice position, length lies within the source bitmap buffer. It does not check whether the running destination cursor has exceeded the...