PT-2026-60981

A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child process.spawn of the file mcp.ts. Executing a manipulation can lead to command injection. The attack can be launched remotely. The attack requires a high level of complexity. The exploitati...

SUSE SLES15 Security Update : joe (SUSE-SU-2026:3108-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3108-1 advisory. This update for joe fixes the following issue - CVE-2026-13412: arbitrary command execution via malicious tags file bsc1269379. Tenable has extracted t...

SUSE SLED15: libruby3_4-3_4 / ruby3.4 / ruby3.4-devel / ruby3.4-devel-extra / etc (SUSE-SU-2026:3090-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3090-1 advisory. This update for ruby3.4 fixes the following issues - CVE-2026-42258: Net:IMAP: Command Injection via Symbol...

Linux Distros Unpatched Vulnerability : CVE-2026-47086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token...

Oracle Linux 10 : ruby4.0 (ELSA-2026-20606)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20606 advisory. - Fix Net::IMAP ResponseReader quadratic complexity vulnerability CVE-2026-42245 Includes core fix plus additional performance optimizations Resolves...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3104-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3104-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client...

Exploit for OS Command Injection in Hikvision Ds-2Cd2026G2-Iu\/Sl_Firmware

HIKRAVEN 🛡️ Advanced Hikvision Security Assessmen...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

Exploit for OS Command Injection in Zoneminder

CVE-2023-26039 Description ZoneMinder is a free, open sou...

MAL-2026-10915 Malicious code in dwh-kafka-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e449e20bd6e20337c410ab313a6781116f481400435e9cc35316c7cb6fcae8fc Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is...

Malicious code in dwh-kafka-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e449e20bd6e20337c410ab313a6781116f481400435e9cc35316c7cb6fcae8fc Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is...

CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core

Overview On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been...

wp2shell-poc

wp2shell PoC The first ever poc of the pre-auth timing-based...

Exploit for CVE-2026-9271

KIM-Guardian Pro CVE-2026-9271 — WordPress KeepInMind Sto...

Security Bulletin:Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking

Summary In addition to many updates of operating system level packages, Multiple vulnerabilities were addressed in IBM Process Automation Manager Open Edition Starter Kit for Banking -9.4.2 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fai...

PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs

Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs Repository https://github.com/termux/proot-distro Maintainer: @sylirre Affected Component Package: proot-distro Affected command: copy Attack surface: Host-side Termux CLI — this is...

Directory Traversal

Overview proot-distro is a PRoot-Distro is a lightweight rootless Linux container management utility built around proot. Affected versions of this package are vulnerable to Directory Traversal via the copy command. An attacker can read or overwrite files outside the intended container root...

GHSA-MFR4-MQ8W-VMG6 PRoot-Distro has Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs

Path Traversal in proot-distro copy — Arbitrary Read, Write, and Persistent Code Execution Outside Container Rootfs Repository https://github.com/termux/proot-distro Maintainer: @sylirre Affected Component Package: proot-distro Affected command: copy Attack surface: Host-side Termux CLI — this is...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

DEBIAN-CVE-2026-50289

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces5 source directive because lib/network.js checkLinuxDCHPInterfaces reads /etc/network/interfaces, extracts a...