GHSA-96H3-5X6V-M776 Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

Summary A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a runnable vendor/bin command that points at that outside file. This is a path traversal and link...

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

Summary A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a runnable vendor/bin command that points at that outside file. This is a path traversal and link...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), boulder-opal-scale-up (>=1.0.7, <=1.0.12) +32 more potentially affected by unknown CVE via dulwich (0.22.8)

dulwich PYPI version 0.22.8 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - appcensus-dynamic-repos =2.0.113, =1.0.7, =3.0.0, =0.1.1, =0.1.0, =0.1.171, =0.1.0, =8.0.1, =0.0.0b0, =2.25.1, =0.4.16.post1, =1.10.0rc3, =4.7.5,...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), boulder-opal-scale-up (>=1.0.7, <=1.0.12) +32 more potentially affected by unknown CVE via dulwich (0.22.8)

dulwich PYPI version 0.22.8 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - appcensus-dynamic-repos =2.0.113, =1.0.7, =3.0.0, =0.1.1, =0.1.0, =0.1.171, =0.1.0, =8.0.1, =0.0.0b0, =2.25.1, =0.4.16.post1, =1.10.0rc3, =4.7.5,...

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the...

Security Bulletin: Vulnerability in socket.io-parser bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the socket.io-parser library, which is affected by a denial of service vulnerability. CVE-2026-69185. Vulnerability Details CVEID:CVE-2026-69185 DESCRIPTION: Socket.IO enables bidirectional and low-latency communication fo...

Exploit for OS Command Injection in Vsftpd_Project Vsftpd

FTP Service Enumeration & vsftpd 2.3.4 Backdoor Validation...

wp2shell-PoC

wp2shell-PoC ⚠ This tool is created solely for educational or bug bounty purpose only. Unauthorized use outside of controlled environments is strictly prohibited. Overview Proof-of-concept for the wp2shell vulnerability chain affecting WordPress Core, combining CVE-2026-63030 and CVE-2026-60137...

SMTP is the key: BPFDoor and AVERAT hitting the network edge

Overview Rapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track ...

Exploit for Unrestricted Upload of File with Dangerous Type in Glpi-Project Glpi

CVE-2025-24801 — GLPI 10.0.17 and prior Authenticated RCE Expl...

CVE-2026-85494 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

CVE-2026-85494 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D...

Exploit for CVE-2026-64560

Redmi 14C “pond” – CVE-2026-64560 Migration Kit Global Rele...

EUVD-2009-5121

ContentKeeper Web Appliance now maintained by Impero Software versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as t...

SUSE CVE-2026-54887

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl DTLS server allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtlsserverconnection:initialhello/3 initializes previouscookiesecret to the empty...

openSUSE 16 Security Update : sccache (openSUSE-SU-2026:21982-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21982-1 advisory. - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243868. - CVE-2026-25541: bytes: integer...

Linux Distros Unpatched Vulnerability : CVE-2026-68495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the...

Linux Distros Unpatched Vulnerability : CVE-2026-68496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the...

Security Bulletin: Multiple Vulnerabilities in Linux Kernel affect IBM Cloud Pak System

Summary Multiple vulnerabilities were found in Linux Kernel in Platform System Manager PSM OS Image for Red Hat Enterprise Linux v8 shipped with IBM Cloud Pak System. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2021-46984...

MAL-2026-17422 Malicious code in shortneer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab The package ships a macOS arm64 Rust-compiled Python extension core.abi3.so fronted by a thin wrapper lb.py. The only exposed Python function,...