PT-2026-83563

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBID TAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the conten...

PT-2026-83634

Name of the Vulnerable Software and Affected Versions D-Link DSM-G600 version 1.01 Description A weakness in the Multipart Handler component allows a remote attacker to perform an out-of-bounds write. This occurs through the manipulation of the /load file.cgi endpoint. An out-of-bounds write is a...

SPIP Autosave Session Unauthenticated RCE

This module exploits an unauthenticated RCE in SPIP use exploit/multi/http/spip/autosaverce msf undefinedautosaverce show actions ...actions... msf undefinedautosaverce set ACTION msf undefinedautosaverce show options ...show and set options... msf undefinedautosaverce run This module requires...

openSUSE 16 Security Update : broot (openSUSE-SU-2026:21675-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21675-1 advisory. Changes in broot: - v1.59.0 CVE-2026-72847 boo1275994 new shellcommand verb attribute: run a command through a shell sh -c / cmd /C so &&, ; and pipes...

Security update for mozjs102 (moderate)

openSUSE Security Update: Security update for mozjs102 Announcement ID: openSUSE-SU-2026:0315-1 Rating: moderate References: 1259713 1259728 1259731 Cross-References: CVE-2026-32776 CVE-2026-32777 CVE-2026-32778 CVSS scores: CVE-2026-32776 SUSE: 8.7...

Security update for v2ray-core (important)

openSUSE Security Update: Security update for v2ray-core Announcement ID: openSUSE-SU-2026:0307-1 Rating: important References: 1258546 1266787 1276119 Cross-References: CVE-2026-27017 CVE-2026-39821 CVE-2026-72815 CVE-2026-72816 CVE-2026-72817 CVSS scores: CVE-2026-39821 SUSE: 9.1...

PT-2026-83566

Name of the Vulnerable Software and Affected Versions D-Link DIR-825M version 1.1.8 Description A command injection issue exists in the System Command Execution component. A remote attacker can manipulate the sysCmd argument within the sub 456CF4 function of the /boafrm/formSysCmd endpoint to...

PT-2026-83556

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in...

Security update for tor (important)

openSUSE Security Update: Security update for tor Announcement ID: openSUSE-SU-2026:0306-1 Rating: important References: 1275918 1275919 1275920 Cross-References: CVE-2026-77584 CVE-2026-77587 CVE-2026-77638 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes three vulnerabiliti...

Security update for python-PyPDF2 (moderate)

openSUSE Security Update: Security update for python-PyPDF2 Announcement ID: openSUSE-SU-2026:0314-1 Rating: moderate References: 1212797 1262669 1262675 1262676 1266821 1266822 Cross-References: CVE-2023-36464 CVE-2026-41168 CVE-2026-41312 CVE-2026-41314 CVE-2026-48156 CVE-2026-48735 Affected...

Security update for gh (important)

openSUSE Security Update: Security update for gh Announcement ID: openSUSE-SU-2026:0309-1 Rating: important References: 1266618 Cross-References: CVE-2026-39821 CVE-2026-64652 CVE-2026-64653 CVE-2026-64654 CVE-2026-64655 CVSS scores: CVE-2026-39821 SUSE: 9.1...

Security update for pyenv (moderate)

openSUSE Security Update: Security update for pyenv Announcement ID: openSUSE-SU-2026:0311-1 Rating: moderate References: 1275661 Cross-References: CVE-2026-68939 CVSS scores: CVE-2026-68939 SUSE: 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Backports SLE-15-SP7 An...

openSUSE 16 Security Update : vim (openSUSE-SU-2026:21671-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21671-1 advisory. Updated to version 9.2.0957. Security issues fixed: - CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service...

PT-2026-83555

Name of the Vulnerable Software and Affected Versions Pake versions prior to 3.13.1 Description The download file Tauri command fails to sanitize the JavaScript-supplied filename before joining it to the user's Downloads directory. This allows a filename containing an absolute path or path...

Security update for trivy (moderate)

openSUSE Security Update: Security update for trivy Announcement ID: openSUSE-SU-2026:0312-1 Rating: moderate References: 1276128 Cross-References: CVE-2026-72815 CVE-2026-72816 CVE-2026-72817 CVSS scores: CVE-2026-72815 SUSE: 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N...

Security update for git-lfs (important)

openSUSE Security Update: Security update for git-lfs Announcement ID: openSUSE-SU-2026:0305-1 Rating: important References: 1239322 1252259 Cross-References: CVE-2025-22869 CVE-2025-26625 CVSS scores: CVE-2025-22869 SUSE: 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

Exploit for Code Injection in Langflow

CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of...

Malicious code in grafeno-webhook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36 The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerate...

MAL-2026-15573 Malicious code in grafeno-webhook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36 The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerate...

Malicious code in grafeno-billing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72306b800994fea3aa6c6d12e137657ffe70ec9ac6c44abfe3ceaa547ef8e5c6 [email protected] is a stub package whose only substantive code is a preinstall lifecycle hook. On npm install, preinstall.js enumerates...