Malware in revine

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

GHSA-343H-94H5-C4WR vulnerabilities

Vulnerabilities for packages: kayenta-fips, dd-trace-java, traccar-fips, trino, hono, apache-polaris-fips, logstash, metabase, conductor, automq-fips, datahub-gms, datahub-gms-fips, apache-pulsar-fips, strimzi-kafka-operator-fips, flink-kubernetes-operator-fips, solr-fips,...

CVE-2026-106450 vulnerabilities

Vulnerabilities for packages: kayenta-fips, dd-trace-java, traccar-fips, trino, hono, apache-polaris-fips, logstash, metabase, conductor, automq-fips, datahub-gms, datahub-gms-fips, apache-pulsar-fips, strimzi-kafka-operator-fips, flink-kubernetes-operator-fips, solr-fips,...

GHSA-GM45-99XC-R7WV vulnerabilities

Vulnerabilities for packages: kayenta-fips, dd-trace-java, traccar-fips, trino, hono, apache-polaris-fips, logstash, metabase, conductor, automq-fips, datahub-gms, datahub-gms-fips, apache-pulsar-fips, strimzi-kafka-operator-fips, flink-kubernetes-operator-fips, solr-fips,...

gcat

Gcat Una backdoor furtiva basata su Python che utilizza Gmail come server di comando e controllo Questo progetto è ispirato al codice PoC originale di Benjamin Donnelly Questo è codice PoC... ... che è stato rilasciato per consentire alle organizzazioni di testare le proprie difese contro questi...

External Control of File Name or Path

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to External Control of File Name or Path via the writemissingweakimports method in src/datamodelcodegenerator/parser/protobuf.py when processing a Protocol Buffers schema file containi...

Exploit for CVE-2026-92555

CVE-2026-92555 — PoC Usage Guide AKINSOFT WOLVOX Control Pa...

Coraza has Cookie Parser Confusion

Summary Coraza's cookie parser internal/cookies.ParseCookies does not strip ASCII control characters CTLs from the edges of a cookie name/value before they're matched against REQUESTCOOKIES / REQUESTCOOKIESNAMES. When a CTL sits directly next to the = separator, Coraza absorbs it into the adjacen...

GHSA-G4QM-M288-5CP9 Coraza has Cookie Parser Confusion

Summary Coraza's cookie parser internal/cookies.ParseCookies does not strip ASCII control characters CTLs from the edges of a cookie name/value before they're matched against REQUESTCOOKIES / REQUESTCOOKIESNAMES. When a CTL sits directly next to the = separator, Coraza absorbs it into the adjacen...

CVE-2026-93861

In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its projectid defaulted to the accepting project rather than t...

CVE-2026-107334 Incorrect Authorization in Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

EUVD-2026-95127

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

How one bug bounty researcher chooses the features they investigate

As we kick off Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to spotlight one of the top-performing security researchers participating in the GitHub Security Bug Bounty Program: @vaib25vicky! The security research community makes GitHub safer for everyone--that's the simple...

SUSE CVE-2026-76151

Out-of-bounds read buffer over-read in the HTTP Cache-Control response header parsing in the QtNetwork module in Qt Group Qt 6.0.0 through 6.8.8, and 6.9.0 through 6.11.1, allows remote attackers to cause a denial of service application crash via an excessively large Cache-Control header value...

WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dcs in WordPress Plugin GIFT4U versions = 1.1.3...

WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Jetpack VideoPress versions = 3.6...

WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Bayarcash WooCommerce versions = 4.4.2...

Access Control Bypass

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Access Control Bypass

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Access Control Bypass

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...