SUSE SLED15: harfbuzz-devel / harfbuzz-tools / libharfbuzz-cairo0 / etc (SUSE-SU-2026:0287-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0287-1 advisory. - CVE-2026-22693: Fixed a NULL pointer dereference in SubtableUnicodesCache::create bsc1256459. Tenable h...

CVE-2025-59090: Missing Authentication for Critical Function

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled...

PT-2026-4740

Name of the Vulnerable Software and Affected Versions exos 9300 server affected versions not specified Description A SOAP API is reachable on port 8002 on the exos 9300 server without requiring authentication. Network access to the server allows for actions such as creating arbitrary access log...

CVE-2026-22988

In the Linux kernel, the following vulnerability has been resolved: arp: do not assume devhardheader does not change skb-head arpcreate is the only devhardheader caller making assumption about skb-head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to improper handling of user data in the XMLExternalEntityParserCreate function. An attacker can cause a denial of service by supplying crafted input that triggers a null pointer dereference. Remediation...

CVE-2026-24515

In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data...

Command Injection

Overview @sunwood-ai-labs/github-kanban-mcp-server is an A Model Context Protocol server for managing GitHub issues as Kanban using gh CLI Affected versions of this package are vulnerable to Command Injection via the createissue parameter. An attacker can execute arbitrary code in the context of...

CVE-2026-0756

github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw...

CVE-2026-0756 github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability

github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw...

PT-2026-4534

Name of the Vulnerable Software and Affected Versions Sourcecodester Domain Availability Checker version 1.0 Description A DOM-based Cross-Site Scripting XSS issue exists in the DomainCheckerApp class within the domain/script.js file. The application does not properly handle user-supplied data in...

CVE-2025-70458

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in Sourcecodester Domain Availability Checker v1.0 . The flaw is located in the DomainCheckerApp class within the domain/script.js file, specifically inside the createResultElement method. The vulnerability is caused by the improper hand...

CVE-2025-70458

A DOM-based Cross-Site Scripting XSS vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the...

GitHub Kanban MCP Server: Operating System Command Injection Vulnerability

GitHub Kanban MCP Server is an application developed by Maki, a personal developer. The GitHub Kanban MCP Server has a vulnerability related to operating system command injection. This vulnerability arises from executing system calls without validating user input when processing the createissue...

EUVD-2025-206330

A DOM-based Cross-Site Scripting XSS vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the...

Linux Kernel Security Vulnerabilities

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from an assumption that devhardheader does not change skb-head when the arpcreate function is called,...

Azure Linux 3.0 Security Update: hyperv-daemons / kernel (CVE-2024-26986)

The version of hyperv-daemons / kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-26986 advisory. - In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory...

Dragonfly Manager Job API Unauthenticated Access

Dragonfly Manager's Job REST API endpoints lack authentication, allowing unauthenticated attackers to create, query, modify, and delete jobs, potentially leading to resource exhaustion, information disclosure, and service disruption...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21997)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21997 advisory. - In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21735)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21735 advisory. - In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in...

Azure Linux 3.0 Security Update: kernel (CVE-2025-22042)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-22042 advisory. - In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for create lease...