276773 matches found
PT-2026-129094
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting proto or constructor. DataTable.setCell, including Dashboards connect...
PT-2026-130598
This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can...
CVE-2026-54162: Improper Neutralization of Escape, Meta, or Control Sequences
Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the fitCellLeft render helper without neutralizing terminal escape or control sequences. An...
Linux Distros Unpatched Vulnerability : CVE-2026-99192
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bcmgenet: unshare the skb before writing the control block bcmgenet stores firstcb, lastcb and bytessent in the skb control block and reads them back on...
Linux Distros Unpatched Vulnerability : CVE-2026-117609
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by...
Linux Distros Unpatched Vulnerability : CVE-2026-118318
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security...
PT-2026-129167
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
Linux Distros Unpatched Vulnerability : CVE-2026-118337
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium...
Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-292
This module allows for direct viewing of a file with the URL alias. This is a followup advisory to SA-CONTRIB-2026-245, which did not fully resolve the underlying vulnerability. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This can...
PT-2026-128246
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...
PT-2026-127794
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and r...
celerystalk
celerystalk celerystalk helps you automate your network scanning/enumeration process with asynchronous jobs aka tasks while retaining full control of which tools you want to run. Interactive Demo: Bug Bounty Mode HackerOne Interactive Demo: Vulnerability Assessment / PenTest Mode Retired...
CVE-2026-118337
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-118318
Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-118318
Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-118318
Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
Malware in csec-form-validator
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in csec-form-validatorr
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in ccsec-form-validator
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
