7183 matches found
PT-2026-77424
Name of the Vulnerable Software and Affected Versions Oracle WebCenter Enterprise Capture version 12.2.1.4.0 Oracle WebCenter Enterprise Capture version 14.1.2.0.0 Description An issue exists in the Client Bundle component of Oracle WebCenter Enterprise Capture. An unauthenticated attacker with...
CUSTOS: Toward Forensic-Ready Zero Trust at the Capture-Containment Boundary
Zero Trust ZT replaces implicit trust with continuous verification, but mutual TLS, ephemeral workloads, identity-centric control, and automated remediation reduce payload visibility, weaken IP-based attribution, and shrink the window for acquiring volatile evidence. We propose CUSTOS, a...
CVE-2026-19695
A flaw was found in the Gammu DCT3 trace file parser in Wireshark. This issue occurs when malformed packets are decoded from a packet capture file, causing a stack-based buffer overflow, resulting in a denial of service. Mitigation To mitigate this vulnerability, do not open untrusted capture fil...
CVE-2026-19694
A flaw was found in the TTX Logger file parser in Wireshark. This issue occurs when malformed packets are decoded from a packet capture file, causing a heap-based buffer overflow, resulting in a denial of service. Mitigation To mitigate this vulnerability, do not open untrusted capture files...
Expression Language (SpEL) Injection
Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...
kubeshark v53.4.0
Network Observability for SREs & AI Agents Live Demo · Docs Kubeshark indexes cluster-wide network traffic at the kernel level using eBPF — delivering instant answers to any query using network, API, and Kubernetes semantics. What you can do: Download Retrospective PCAPs — cluster-wide packet...
CVE-2026-73683: Authentication Bypass by Capture-replay
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...
CVE-2026-17045: Authentication Bypass by Capture-replay
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...
Wireshark Analyzer 4.6.8
Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. Thi...
EUVD-2026-57323
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, createmobiledatacollectionserver and createmobileactionserver in ufo/client/mcp/httpservers/mobilemcpserver.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without...
MAL-2026-13879 Malicious code in dakumangalsingh (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...
EUVD-2026-57006
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...
CVE-2026-17268: Authentication Bypass by Capture-replay
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token...
CVE-2026-73431: Authentication Bypass by Capture-replay
Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...
CVE-2026-67558
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...
CVE-2026-67558 Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...
CVE-2026-67558
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...
CVE-2026-33921
A flaw was found in the Npcap driver. The Windows installer for Arc deployed Npcap with insecure default access restrictions, allowing any local user, not just administrators, to access the driver. This vulnerability enables a local user without administrative privileges to capture network traffi...