GHSA-Q6HH-GP44-4HCM Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Summary Config file parsers, json, yaml, xml etc in parser.go have no file size limit/checks, allowing for a giant config file to potentially OOM the wings process. Impact All wings users who have an egg with a non-file parser configuration file setting...

CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

SUSE CVE-2026-48709

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not cal...

CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-59327

CVE-2026-59327 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue is that the Spring Boot DevTools remote secret (spring.devtools.remote.secret) is stored as a plain string attribute on the "Spring Boot DevTools Client" launch configuration and persisted as cleartext XML, either in w...

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-45695

A flaw was found in Kopia, a cross-platform backup tool. An unauthenticated remote attacker can exploit the HTTP server, when started without a password, by sending specially crafted requests to the /api/v1/repo/exists endpoint. This allows the attacker to forward malicious SFTP storage...

Targeted Quarantine Strategies Mitigate SIS-Model Cyber Epidemics on Complex Networks

The rapid expansion of highly connected and heterogeneous digital infrastructures has fundamentally altered the dynamics of cyber epidemics, making it increasingly important to understand how malware propagates under realistic structural and policy conditions. In this study, we employ an SIS...

cve-2026-59327 - MEDIUM - CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

MAL-2026-11125 Malicious code in api-rust-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 268179cffa6aef31ad248757e61fc892cb826bde059502b3e2c3a74277951e05 On npm install, the package's postinstall hook node test.js executes two payloads against the installer host. First, it fetches an attacker-controlle...

PT-2026-65414

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

SUSE CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-16232 Authentication Bypass in the SmartConsole Login Process Using an Application Token

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security polici...

[SECURITY] Fedora 43 Update: nuclei-3.11.0-1.fc43

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaborati on to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud...

CVE-2026-63982

A flaw was found in the Linux kernel's network scheduler component. This vulnerability occurs when the mirred action, used for redirecting network traffic, fails to properly detect a redirection loop. An attacker can exploit this by crafting specific network configurations that cause packets to b...

PT-2026-60638

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to...

CVE-2026-30623

A flaw was found in LiteLLM. This vulnerability allows a remote attacker to execute arbitrary operating system commands on the host where LiteLLM is running. This is possible because the application's MCP server creation functionality processes JSON configurations that can include unvalidated...

CVE-2026-46459

ICU Scandinavia Boomerang is affected by a missing authentication vulnerability in its device receiver endpoints. An unauthenticated remote attacker can read full facility configurations and write unauthorized data to the sensor database. The issue is mitigated by upgrading to version 2.4.18.029....

EUVD-2026-44667

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029...

CVE-2026-46459 Missing Authorization in ICU Scandinavia Boomerang

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database. This issue has been fixed in version 2.4.18.029...