ROS-20260818-73-0003

The vulnerability in Wireshark relates to executing a loop with an unavailable exit condition. Exploiting this vulnerability can allow a hacker to cause a service failure...

ROS-20260818-73-0004

The vulnerability in Wireshark is related to copying buffers without checking the size of the input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Countersoft Gemini 7.3.0 SQL Injection / Remote Code Execution

Countersoft Gemini version 7.3.0 contains an authenticated SQL injection vulnerability in the custom field lookup functionality. An attacker with valid credentials can inject stacked SQL queries through the term parameter and, when the application uses a privileged SQL Server account, enable...

Exploit for Classic Buffer Overflow in Cisco Secure_Endpoint

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant repr...

Exploit for CVE-2026-71518

CVE-2026-71518 — Typemill Unauthenticated Authorization Bypass...

CVE-2026-56677

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...

GHSA-8G4W-4FFG-8VGX 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...

GHSA-P28P-J94Q-PG32 http4k: `DigestAuthProvider.verify` did not bind to request URI

Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...

http4k: `DigestAuthProvider.verify` did not bind to request URI

Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...

GHSA-VXXM-WWQH-MH47 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

Impact An issue in DigestAuthProvider.verify: Algorithm silently forced to MD5. The configured algorithm parameter was ignored — every verification used MD5 regardless of configuration. Deployments believing they were running SHA-256 Digest auth were silently inheriting MD5's collision weaknesses...

CVE-2026-75111

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...

CVE-2026-75105

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/tempshare/index.php and app/tempshare/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an...

CVE-2026-67926

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module...

CVE-2026-40506

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

CVE-2026-56677

9Router 0.5.4 and earlier is vulnerable to unauthenticated SSRF: the POST /api/auth/oidc/test endpoint passes a user-supplied issuerUrl to fetchOidcDiscovery() without blocking private/loopback IPs, allowing internal service scanning and reflection of OIDC discovery fields (token_endpoint, jwks_u...

CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

EUVD-2026-60471

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...