ROS-20260818-73-0001

The vulnerability in Wireshark is related to the use of uncontrolled format lines. The vulnerability can be exploited remotely...

ROS-20260818-73-0002

The vulnerability in Wireshark is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

ROS-20260818-73-0004

The vulnerability in Wireshark is related to copying buffers without checking the size of the input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

EUVD-2026-61096

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

PT-2026-77222

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the execute mode=PREPARE parameter of run.php...

Countersoft Gemini 7.3.0 SQL Injection / Remote Code Execution

Countersoft Gemini version 7.3.0 contains an authenticated SQL injection vulnerability in the custom field lookup functionality. An attacker with valid credentials can inject stacked SQL queries through the term parameter and, when the application uses a privileged SQL Server account, enable...

PT-2026-77030

Dolibarr contains an authorization bypass vulnerability in the clonetasks mass action that allows authenticated users with project creation permissions to clone tasks into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check...

PT-2026-77163

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description An argument injection flaw exists in the git blame tool. This occurs because the rev parameter is not properly validated, allowing attackers to inject git options. By providing specific values to...

Wavestore VMS 6.48.809 Remote Code Execution

Wavestore VMS version 6.48.809 contains a command injection vulnerability in the venusd /simple/export endpoint. An authenticated remote attacker can inject shell metacharacters into the user parameter, which is URL-decoded and passed without sanitization to a command executed through popen...

Linux Distros Unpatched Vulnerability : CVE-2026-74287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed...

Linux Distros Unpatched Vulnerability : CVE-2026-72471

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing runlookup to return false. This causes...

Linux Distros Unpatched Vulnerability : CVE-2026-72194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: add depth limit to indxfindbuffer to prevent stack overflow indxfindbuffer recursively descends the B+ tree index with no depth limit. A crafted NTFS...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101998 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIEECHO processing When a listening SCTP serve...

Amazon Linux 2023 : python3-jwt, python3-jwt+crypto (ALAS2023-2026-2051)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2051 advisory. PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector...

Linux Distros Unpatched Vulnerability : CVE-2026-72478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: add bounds check to rungethighestvcn rungethighestvcn parses a packed NTFS mapping- pairs buffer without any length bound, relying solely on a 0x00...

Exploit for Classic Buffer Overflow in Cisco Secure_Endpoint

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant repr...

Exploit for CVE-2026-71518

CVE-2026-71518 — Typemill Unauthenticated Authorization Bypass...

CVE-2026-56677

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...

GHSA-8G4W-4FFG-8VGX 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...