PT-2026-5550

SunFounder Pironman Dashboard pm dashboard version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints. An unauthenticated remote attacker can supply traversal sequences via the filename parameter to read and delete arbitrary files. Successful exploitation can...

Ubuntu: Security Advisory (USN-7987-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SmarterMail < 100.0.9511 Auth Bypass (CVE-2026-23760)

The version of SmarterTools SmarterMail installed on the remote host is prior to 100.0.9511. It is, therefore, affected by an authentication bypass vulnerability. SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The...

CVE-2026-25116

Runtipi (homeserver orchestrator) is vulnerable in versions 4.5.0–4.7.1 due to an unauthenticated Path Traversal in UserConfigController caused by insecure URN parsing, allowing remote overwrite of docker-compose.yml and resulting in full Remote Code Execution and host filesystem compromise upon ...

CVE-2026-25116

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulnerability in the UserConfigController allows any remote user to overwrite the system's docker-compose.yml configuration file. By exploiting insecure URN...

CVE-2026-24769

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting XSS vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline...

CVE-2026-24845

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses...

EUVD-2025-206542

The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account...

Malicious code in jwt-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4102b59becb214e216d479ce014231e41dd264560b48ef7750c7006a3c86e7d6 The package jwt-pack was found to contain malicious code. Source: ghsa-malware c16aba10441aad949bd96fd2a349f2f59d62bf56708394fd925b432c57e2c91b Any...

Malicious code in n8n-nodes-comfyui-illu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f55ef8a1d72164c700fe4a5c05d4fa8150e2162291f8a65f5505304b2aeb46b The package n8n-nodes-comfyui-illu was found to contain malicious code. Source: ghsa-malware...

MAL-2026-597 Malicious code in n8n-nodes-comfyui-illu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f55ef8a1d72164c700fe4a5c05d4fa8150e2162291f8a65f5505304b2aeb46b The package n8n-nodes-comfyui-illu was found to contain malicious code. Source: ghsa-malware...

MAL-2026-598 Malicious code in wallet-icon-font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a89aa304ab9d5d7a44ee3e88112f9e35b876ad03a87090749c929e882289c721 The package wallet-icon-font was found to contain malicious code. Source: ghsa-malware 319f118931c6d4b46c7bf09c9474dd23e24873b1c32f093f631cc3dccd10ec...

HCL AION File Upload Vulnerability

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from a file upload vulnerability that can be exploited by an attacker to upload malicious files leading to arbitrary code execution or system compromise...

Unspecified Vulnerability in HCL AION (CNVD-2026-16406)

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from a security vulnerability that is caused due to improper handling of host headers that enable host header injection. An attacker can exploit the vulnerability to allow malicious file uploads, resulting in...

Notepad++ 8.9 Persistence Module

This Metasploit post-exploitation module abuses a legitimate Notepad++ feature by modifying the shortcuts.xml configuration file to register a custom external tool. The added tool appears in the Notepad++ Run menu and executes a user-defined command when manually selected by the user. This...

NocoDB Vulnerable to Stored Cross-Site Scripting via SVG upload

Summary A stored Cross-site Scripting XSS vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because...

A single post-release of dydx-v4-client contained obfuscated multi-stage loader

A PyPI user account compromised by an attacker and was able toupload a malicious version 1.1.5.post1 of the dydx-v4-client package.This version contains a highly obfuscated multi-stage loaderthat ultimately executes malicious code on the host system.While the final payload is not visible because ...

CVE-2026-24769

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting XSS vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline...

EUVD-2026-4868

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting XSS vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline...

CVE-2026-24769

NocoDB (the spreadsheet-like database tool) has a stored XSS vulnerability in its attachment handling. Prior to version 0.301.0, authenticated users can upload SVGs containing JavaScript which are stored server-side and later rendered inline, executing in other users’ browsers. Root cause identif...