PT-2026-4533

Name of the Vulnerable Software and Affected Versions Sourcecodester Modern Image Gallery App version 1.0 Description A Remote Code Execution RCE issue exists in the gallery/upload.php component of the application. The application does not properly validate uploaded file contents and preserves...

Moodle security vulnerabilities

Moodle is an open-source e-learning software platform developed by Moodle, also known as a course management system, learning management system, or virtual learning environment. There are security vulnerabilities in Moodle; these vulnerabilities stem from insufficient input validation, which may...

EUVD-2026-3804

Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration e.g a member of the ‘incus’ group can create an environment variable containing newlines, which can be used to add additional...

CVE-2026-22793

5ire is a cross-platform desktop artificial intelligence assistant and model context protocol client. Prior to version 0.15.3, an unsafe option parsing vulnerability in the ECharts Markdown plugin allows any user able to submit ECharts code blocks to execute arbitrary JavaScript code in the...

CVE-2026-23960

A flaw was found in Argo Workflows, an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. This stored Cross-Site Scripting XSS vulnerability in the artifact directory listing allows any workflow author to execute unauthorized JavaScript code in another...

Incus container environment configuration newline injection

Summary A user with the ability to launch a container with a custom YAML configuration e.g a member of the ‘incus’ group can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to the newline injection. This c...

MAL-2026-464 Malicious code in @ikeacn/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ddd87692493182b2706890d61f428455b6686768925e979c7ad73ed8aed0b8 The package @ikeacn/icons was found to contain malicious code. Source: ghsa-malware 1fd9107408adaea60e793eab4b396b70fa0ec9b4dff087a3f16e52eb21be6450...

CVE-2026-23760

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An...

CVE-2026-23760

SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An...

MAL-2026-454 Malicious code in @mailpoet/component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d48b40574c65ef747944583fa5a49ac40b673d6932a02247c2cdbd5331a79179 The package @mailpoet/component was found to contain malicious code. Source: ghsa-malware...

Malicious code in @alluxio/common-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f082b7a72d74e881f10d6e0f01c1aef7a0a07b0f446d5a9d31a4763ffed2ed8 The package @alluxio/common-ui was found to contain malicious code. Source: ghsa-malware...

MAL-2026-458 Malicious code in csv-parsing-xz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbd0bb44a5de8aaaa9d2397fe8ff5fa7e9a7274bb5d6efe9ef6af97ba8747692 The package csv-parsing-xz was found to contain malicious code. Source: ghsa-malware 40d41fc1adde6793bd8a6626e41da04bcb68b4934a4760eeb34c278ed6165adf...

MAL-2026-457 Malicious code in csv-parsing-xx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfe9a306ce309515a134b6348aff27991f8725d7925ee31b1c51281c9d4a5bc8 The package csv-parsing-xx was found to contain malicious code. Source: ghsa-malware 3e16868b929858d45e76857e9157eae0e3631ca0e2e5988e69c6f537d0ad1a04...

Resurgence of a multi‑stage AiTM phishing and BEC campaign abusing SharePoint

Microsoft Defender Researchers uncovered a multi‑stage adversary‑in‑the‑middle AiTM phishing and business email compromise BEC campaign targeting multiple organizations in the energy sector, resulting in the compromise of various user accounts. The campaign abused SharePoint file‑sharing services...

Resurgence of a multi‑stage AiTM phishing and BEC campaign abusing SharePoint

Microsoft Defender Researchers uncovered a multi‑stage adversary‑in‑the‑middle AiTM phishing and business email compromise BEC campaign targeting multiple organizations in the energy sector, resulting in the compromise of various user accounts. The campaign abused SharePoint file‑sharing services...

Azure Linux 3.0 Security Update: samba (CVE-2020-25719)

The version of samba installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-25719 advisory. - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name- based...

PT-2026-4301

Name of the Vulnerable Software and Affected Versions EVMAPA affected versions not specified Description A missing authentication mechanism in a WebSocket endpoint allows unauthorized access to sensitive data and potential privilege escalation. Attackers can establish connections without...

Azure Linux 3.0 Security Update: samba (CVE-2020-25722)

The version of samba installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-25722 advisory. - Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. ...

CVE-2026-21927

Vulnerability in the Oracle Solaris product of Oracle Systems component: Driver. The supported version that is affected is 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful...

CVE-2026-21935

Vulnerability in the Oracle Solaris product of Oracle Systems component: Driver. The supported version that is affected is 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful...