PT-2026-46320

Name of the Vulnerable Software and Affected Versions Geya versions prior to 1.16 Description An unauthenticated Local File Inclusion LFI exists, which allows an attacker to include and read local files on the server without requiring authentication. Recommendations Update to a version later than...

PT-2026-46327

Name of the Vulnerable Software and Affected Versions AirSupply versions prior to 2.0.1 Description An unauthenticated Local File Inclusion LFI exists, which allows an attacker to read files from the local file system without requiring authentication. Recommendations Update to a version newer tha...

PT-2026-46324

Name of the Vulnerable Software and Affected Versions Rosaleen versions prior to 2.9 Description An unauthenticated Local File Inclusion LFI exists, which allows an attacker to include files from the local file system without requiring authentication. Recommendations Update to a version newer tha...

PT-2026-46329

Name of the Vulnerable Software and Affected Versions Planty versions prior to 1.14.1 Description An unauthenticated Local File Inclusion allows an attacker to read files from the local file system without requiring authentication. Recommendations Update to a version newer than 1.14.0...

PT-2026-46330

Name of the Vulnerable Software and Affected Versions Nexio versions prior to 1.10.1 Description An unauthenticated Local File Inclusion LFI exists, which allows an attacker to read arbitrary files from the local file system without requiring authentication. Recommendations Update to a version...

Backdoor Attacks on Fault Detection and Localization in Cyber-Physical Systems

Cyber-Physical Systems CPS integrate sensing, communication, computation, and control to support critical infrastructure, including smart grids, industrial automation, and control systems. In the electrical utility domain, various controllers are used in CPS to ensure the system detects and...

PT-2026-46331

Name of the Vulnerable Software and Affected Versions MaxiNet versions prior to 1.2.11 Description An unauthenticated Local File Inclusion allows an attacker to read files from the local file system without requiring authentication. Recommendations Update to a version newer than 1.2.10...

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks. According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 CVSS score: 9.4, an SQL injection vulnerability in...

The vulnerability of theOTP library set up in the Erlang programming language, related to deficiencies in handling http requests, allows attackers to carry out attacks by replacing HTTP requests.

The vulnerability of theOTP library in the Erlang programming language is related to deficiencies in handling http requests. Exploiting this vulnerability allows a malicious actor to carry out attacks by replacing HTTP requests...

The vulnerability of the user remote access agent for corporate resources and Prisma Access applications lies in authentication process errors, which allow attackers to execute “man-in-the-middle” attacks.

The vulnerability of the Prisma Access Agent, a user remote access agent, relates to errors in the certificate validation process. Exploiting this vulnerability allows an attacker to execute a “man-in-the-middle” type attack...

unbound: Unbound DNS Cache Poisoning via Promiscuous Additional Section RRSet Acceptance

A flaw was found in Unbound's handling of DNS reply messages, complementing the earlier CVE-2025-11411 fix. Unbound accepts and caches address records from the additional section of DNS replies when they accompany authority section RRSets other than NS such as MX records. A malicious actor who ca...

Reversing-Toolkit

Reversing Toolkit 🔧 3 reverse engineering & binary exploita...

CVE-2025-26483

CVE-2025-26483 affects Dell PowerFlex Manager (versions 4.6.2 and earlier). The issue is an Open Redirect vulnerability that can allow an unauthenticated attacker to redirect users to arbitrary URLs, enabling phishing that could lead to data disclosure. No exploit details are provided in the docu...

CVE-2026-8673 Password re-initialization mechanism sends passwords in plain text

Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0...

CVE-2026-8673

Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0...

EUVD-2026-31353

Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks. These versions use Perl's built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password...

PT-2026-42754

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.1 Apache CXF versions prior to 4.1.6 Apache CXF versions prior to 3.6.11 Description Insecure XML parser configuration in the WS-Transfer module may allow attackers to perform XML External Entity XXE attacks. X...

Avantra 安全漏洞

Avantra is a SAP software developed by the Avantra company. Versions of Avantra prior to 25.3.0 contained security vulnerabilities. These vulnerabilities stemmed from unprotected credential transmission, which could lead to sniffing attacks...

Adversarial Vulnerability under Temporal Concept Drift: A Longitudinal Study of Android Malware Detection

We present a longitudinal, drift-aware evaluation of adversarial robustness across more than a decade of Android applications using static and dynamic feature representations extracted from emulator and real-device executions. The dataset is organized into yearly slices and evaluated under three...

Dell PowerFlex Manager 输入验证错误漏洞

Dell PowerFlex Manager is a product of the American company Dell. Versions of Dell PowerFlex Manager prior to 4.6.2 contained a vulnerability related to input validation. This vulnerability stemmed from open redirection, allowing unauthenticated attackers to redirect target application users to...