CVE-2026-5936

An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints e.g., cloud metadata services, or bypass...

CVE-2026-40436 ZTE ZXEDM iEMS product has a password reset vulnerability

The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the...

CVE-2026-40436 ZTE ZXEDM iEMS product has a password reset vulnerability

The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the...

CVE-2026-40436

The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the...

PT-2026-32281

The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the...

PT-2026-32443

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.13 through 9.0.116. Users are...

PT-2026-32283

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior m...

Zero Day Quest 2026: $2.3 million awarded for vulnerability research

Protecting customers is at the core of Zero Day Quest. During the 2026 live hacking event, Microsoft partnered with the global security research community, representing more than 20 countries and a wide range of professional backgrounds, from high school students to college professors. Together,...

PT-2026-32707

These are all security issues fixed in the oci-cli-3.76.2-1.1 package on the GA media of openSUSE Tumbleweed...

Exploit for CVE-2026-40175

🚨 CVE-2026-40175 - Critical Vulnerability in Axios...

The Best Vulnerability Scanning Tools for 2026: A Complete Guide

Your vulnerability scanner found 14,000 issues last quarter. Your team patched 800. The other 13,200 are sitting in a spreadsheet that nobody opens anymore. This is the reality for most security teams. The scanner works. It finds vulnerabilities. But without context, prioritization, or a clear pa...

RGui 代码问题漏洞

RGui is a web interface system for cloud platform management and resource visualization operations by The R Foundation. Version RGui 3.5.0 has a code vulnerability; this vulnerability stems from a local buffer overflow in the GUI preferences dialog box, which may allow arbitrary code to be execut...

infosec-notebook

infosec-notebook Personal cybersecurity notes and references...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: helm-set-status, incert, grafana-operator, filebrowser, kubernetes, oras, apko, datadog-agent, mattermost, dive, kots, bento, task, gitness, ipfs-cluster, mailpit, malcontent, cosign, falcoctl, xeol, external-secrets-operator, coredns, dex, atlantis, buildah,...

GHSA-M4PR-4J3G-9V7V vulnerabilities

Vulnerabilities for packages: helm-set-status, argo-events, incert, certificate-transparency, grafana-operator, mc, kubernetes, apko, datadog-agent, mattermost, smarter-device-manager, temporal-ui-server, bento, multus-cni, spicedb-operator, malcontent, grafana-agent-operator, cosign, mailpit,...

CVE-2026-32280 vulnerabilities

Vulnerabilities for packages: helm-set-status, argo-events, incert, certificate-transparency, grafana-operator, mc, kubernetes, apko, datadog-agent, mattermost, smarter-device-manager, temporal-ui-server, bento, multus-cni, spicedb-operator, malcontent, grafana-agent-operator, cosign, mailpit,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: helm-set-status, argo-events, incert, certificate-transparency, grafana-operator, mc, kubernetes, apko, datadog-agent, mattermost, smarter-device-manager, temporal-ui-server, bento, multus-cni, spicedb-operator, malcontent, grafana-agent-operator, cosign, mailpit,...

CVE-2026-27140 vulnerabilities

Vulnerabilities for packages: helm-set-status, argo-events, incert, certificate-transparency, grafana-operator, mc, kubernetes, apko, datadog-agent, mattermost, smarter-device-manager, gitea, temporal-ui-server, velero-plugin-for-microsoft-azure, bento, multus-cni, spicedb-operator, malcontent,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: helm-set-status, argo-events, incert, certificate-transparency, grafana-operator, mc, kubernetes, apko, datadog-agent, mattermost, smarter-device-manager, temporal-ui-server, bento, multus-cni, spicedb-operator, malcontent, grafana-agent-operator, cosign, mailpit,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: minio-object-browser, helm-set-status, terraform-provider-tls, argo-events, cloud-provider-azure, certificate-transparency, terraform-provider-sendgrid, opencost, mc, filebrowser, sftpgo-plugin-eventsearch, kubernetes, apko, datadog-agent, mattermost,...