PT-2026-103117

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103048 Open Redirect in Special:Book

URL redirection to untrusted site 'open redirect' vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103048

The Wikimedia Foundation Mediawiki - Collection extension is vulnerable to a URL redirection to untrusted site ('open redirect') vulnerability, which can allow an attacker to redirect users to a malicious site and fake the source of data . This issue impacts Mediawiki - Collection extension versi...

CVE-2026-103048 Open Redirect in Special:Book

URL redirection to untrusted site 'open redirect' vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10...

Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

MAL-2026-17288 Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

Exploit for Out-of-bounds Read in Linux Linux_Kernel

Linux container escape PoCs Target-specific proof-of-concept...

PT-2026-102941

Name of the Vulnerable Software and Affected Versions Mediawiki - Collection extension versions prior to 1.46.1 Mediawiki - Collection extension version 1.45.5 Mediawiki - Collection extension version 1.43.10 Description An open redirect issue exists in the Mediawiki - Collection extension, which...

CVE-2026-97534

A flaw was found in the Linux kernel's Flash-Friendly File System F2FS. When segment ranges are truncated, the file system fails to properly adjust the free section counter for sections that were already marked free, leading to an overestimation of available storage during background garbage...

CVE-2026-93285

A flaw was found in the Linux kernel's Flash-Friendly File System F2FS. A race condition exists during filesystem remount or shutdown operations where background garbage collection tasks are improperly synchronized with teardown routines. A local user could exploit this timing flaw through...

CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

5G-Shark Lures Phones to Rogue 5G Cells Without Network Jamming

Researchers have developed 5G-Shark to lure phones onto rogue base stations, collect subscriber IDs, force network downgrades and…...

DEBIAN-CVE-2026-98050

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

Emat

Emat Emat is an advanced scraping tool designed to collect email accounts from platforms like Gmail, Yahoo, Hotmail, and government email services. However, it's crucial to emphasize that the script should only be used for educational purposes and not for any abusive or unethical activities. To...

PT-2026-98474

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the f2fs filesystem within the free segment range function. The system temporarily reduces MAIN SECSsbi by secs to limit block allocation to a safe area while Garbage...

The vulnerability of the journal message formation mechanism during the check of the MongoDB database system’s collection schema allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the journal message formation mechanism, when checking the schema of the MongoDB database management system’s collection, is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

The vulnerability of the Kibana visualization service’s collection management mechanism allows a perpetrator to trigger a service failure.

The vulnerability of the Kibana visualization service’s collection management mechanism is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-26012

CVE-2026-26012 - Prueba de Concepto Omisión de Permisos de Colección para Miembros Autenticados y Enumeración de Cifrados Vaultwarden Referencia NVD: CVE-2026-26012 CVSSv3| Vector de Ataque| Complejidad de Ataque| Privilegios Requeridos| Interacción del Usuario| Confidencialidad| Integridad|...

Google’s location data privacy failures draw a €403 million fine

The Irish Data Protection Commission DPC has fined Google €403 million $459 million for violating European privacy law. The penalty follows a six-year inquiry into Google’s management of user location data between May 2018 and February 2020. During that time, Google collected users’ location data...