CVE-2026-68899 Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

CVE-2026-68899 Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

CVE-2026-68899 Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

CVE-2026-68899

Prior to Wekan 9.90, detectMimeFromFile() in models/fileValidation.js returned undefined when the Unix file binary was absent, causing validation to fall back to attacker-controlled fileObj.type via server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authentic...

CVE-2026-53614

A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...

lamda v10.6

FIRERPA Android ｜ AI-Powered Automation An all-in-one Android automation framework that combines on-device services, AI-ready agents, and extensible tool invocation. Documentation | 使用文档 | TELEGRAM | QQ Group | SKILLS | llms-full.txt | 中文版本 FIRERPA is an all-in-one Android device control platform...

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to...

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Security teams are overwhelmed with findings but still struggle to answer a simple question: which risks matter right now? A vulnerability alone is rarely the problem. The same vulnerability running in production, exposed through a misconfiguration or over-permissioned identity, is a real path to...

qemu v11.1.0

=========== QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in software without any need for hardware virtualization support. By using dynamic translation, it achieves very good performance. QEMU can also...

rockbase

rockbase !CIhttps://github.com/baocin/rockbase/actions/wo...

CVE-2026-71961

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The synccommand binary forwards unsanitized...

EUVD-2026-62418

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The synccommand binary forwards unsanitized...

CVE-2026-71961 Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The synccommand binary forwards unsanitized...

CVE-2026-71961 Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The synccommand binary forwards unsanitized...

CVE-2026-71961

Cudy WR3000 firmware before 2.5.24 is vulnerable: the sync_command binary passes unsanitized MQTT input to a shell sink in command.lua, allowing authenticated attackers with broker access to execute arbitrary root-level commands. CVSS 8.8 HIGH; update to firmware 2.5.24. No in-the-wild exploitati...

Cybermes

🛡️ Cybermes Autonomous Offensive Security, Bug Bounty &...

SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs

A previously unreported cyber espionage operation dubbed SilkParasite has been observed targeting government bodies in Central Asia. The intrusion set makes use of seven remote access tool RAT families, five of which have never been previously documented: DriveSilkRAT, CookiETagRAT, NomadRAT,...

miasma v0.4.2

🌀 Miasma AI companies continually scrape the internet at an enormous scale, swallowing up all of its contents to use as training data for their next models. If you have a public website, they are already stealing your work. Miasma is here to help you fight back! Spin up the server and point any...

Exploit for Missing Release of Memory after Effective Lifetime in Linux Linux_Kernel

CVE-2026-53365 — VsockDrop:iouring + AFVSOCK: Improper refer...

PYSEC-2026-3682 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...