EUVD-2026-62224

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function getparafromuri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

CVE-2026-76008

Comfast CF-N1-S 2.6.0.1 has a stack-based buffer overflow in the get_para_from_uri function of /cgi-bin/mbox-config, triggered by manipulating the width/height URI parameters. CVSS 10.0 (Critical) allows unauthenticated remote attackers to achieve full system compromise. No patch or exploit detai...

CVE-2026-76008 Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function getparafromuri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

PT-2026-80756

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The web url read tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when MCP HT...

CVE-2026-76221: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:3635-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3635-1 advisory. - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used...

PT-2026-78262

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get para from uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely...

ansible-core security update

1:2.14.18-3.1 - Fix CVE-2026-11332 prevent arbitrary git configuration via role requirements RHEL-194134...

Oracle Enterprise Manager Cloud Control (August 2026 CSPU)

The 13.5 and 24.1 versions of Enterprise Manager Cloud Control installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component:...

Malicious code in vite-svg-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f The package's exported getPlugin/setPlugin functions decode two base64 constants svgValidateKey, svgValidatePattern at runtime. svgValidateKey decode...

GHSA-7CJ5-V4PP-V632 LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

Summary The graphdescr. family of settings is echoed verbatim without htmlspecialchars in includes/html/pages/graphs.inc.php:194. Any admin can store a malicious HTML payload that executes in every authenticated user's browser viewing that graph type. CVSS...

GHSA-JF24-8G2H-2WG7 LibreNMS Vulnerable to Remote Code Execution via AboutController

Remote Code Execution via AboutController in LibreNMS Summary A Remote Code Execution RCE vulnerability exists in LibreNMS 26.3.1 through the AboutController. An authenticated administrator can manipulate the snmpget configuration parameter to execute arbitrary system commands. When the /about...

CVE-2026-61284

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Application Config Console. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

EUVD-2026-61352

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Application Config Console. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromi...

curl: Fix of 2 CVEs

CVE-2026-8927: fix cross-proxy Digest auth state leak with env-set proxies - CVE-2026-8932: fix incomplete mTLS config matching in connection reuse...

CVE-2026-75911

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

CVE-2026-75859

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

OPENSUSE-SU-2026:21599-1 Security update for kitty

This update for kitty fixes the following issues: Changes in kitty: - Update to 0.48.2: Wayland: Fix regression in previous release that broke drag and drop on Plasma 10284 diff kitten: Fix a rare crash when showing a large diff due to incorrect locking when highlighting Allow the private DCS...

CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

CVE-2026-75911 CodeWhale before 0.8.64 Remote Code Execution via allow_shell

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...