2572 matches found
CVE-2026-63242
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
CVE-2026-63240 Information disclosure vulnerability
An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising the integrity of assessments...
CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
EUVD-2026-50121
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
CVE-2026-14300
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents
Large language model LLM agents automate penetration testing through an observation-action loop, selecting actions based on observations returned by tools. This dependence allows defenders to inject deceptive observations that can mislead the agent's decision-making process. However, existing...
PT-2026-65713
A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint without viewing the lesson material, compromising training and completion records...
ALSA-2026:47982 Important: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-57456 vim: Vim:...
PT-2026-65697
The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification Profile Completion feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid sessi...
Important: vim security update
Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-57456 vim: Vim:...
CVE-2026-56822
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to se...
CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...
CVE-2026-47427 GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handler
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...
GHSA-W4Q6-QW23-4RG7 GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
Summary A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service. Details The CompletionsHandler functio...
GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete Handler
Summary A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service. Details The CompletionsHandler functio...
JLSEC-2026-797 Windows IOCP lifetime bugs can corrupt memory during cancellation or shutdown
Reseau releases before 1.3.3 contain related lifetime defects in the Windows I/O completion port IOCP backend. During cancellation or event-loop shutdown, the package can stop retaining memory that the Windows kernel still owns. A remote peer that can time or stall I/O around application-driven...
JLSEC-2026-803 Windows IOCP poller races unsynchronized registration tables
Reseau 1.0.0 through 1.3.1 access the Windows I/O completion port IOCP backend's registration dictionary and zombie vector concurrently from the poller and application threads without consistently taking the same lock. A remote peer can increase the likelihood of the race by driving connection...
Ametys CMS Information Disclosure Detection
Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml and similar pathnames for other languages via the auto-completion plugin, which contain all characters typed by all users, including the content of...
SUSE SLES15 Security Update : vim (SUSE-SU-2026:3271-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3271-1 advisory. This update for vim fixes the following issues - Updated to version 9.2.0780. - CVE-2026-59856: Arbitrary Code Execution via PHP...