Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync...

SUSE-SU-2026:4254-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcpconnrequest bsc1235944 bsc1269731. - CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsyn...

EUVD-2026-81906

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036

Appwrite before 2.0.0 contains an argument injection vulnerability in the providerRootDirectory parameter used to construct GNU tar commands. The root cause is the use of escapeshellcmd instead of escapeshellarg without proper quoting, allowing TAB characters to survive sanitization and be interp...

CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

ToolShell-Honeypot

ToolShell-Honeypot SharePoint Zero-Day A Docker-based honeypot focused on detecting and logging exploitation attempts against Microsoft SharePoint zero-day vulnerabilities. This honeypot is designed for early detection and threat intelligence, not for simulating a full SharePoint environment or...

CVE-2026-76578

CVE-2026-76578 — FreeIPA Anonymous Admin Takeover Product: FreeIPA 4.9.x – 4.13.3 Severity: Critical CVSS 9.8 Fixed: FreeIPA 4.13.4 / 389-ds-base 3.2.0-10.el102 RHSA-2026:64785 Legal Notice This proof-of-concept was developed and executed exclusively within an isolated, privately owned lab...

Philips-PM-5139-5138A-5136-Firmware-Project

Philips PM5139 — Firmware Reverse Engineering A 20 MHz function generator from about 1994, taken apart in software: two EPROM dumps, an 8051 emulator used as a measuring instrument, and 35 sections of documentation where every single claim is backed by a listing address, an emulator measurement, ...

mjet

MJET by MOGWAI LABS MOGWAI LABS JMX Exploitation Toolkit MJET is a fork of sjet, which was developed by siberas but is no longer actively maintained. MJET is maintained by the MOGWAI LABS team which also provided most of the original sjet codebase. MJET allows an easy exploitation of insecure...

CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-93014

RosarioSIS versions before 12.9 are affected by a path traversal vulnerability in the filename request parameter within the Users and Students modules. Insufficient validation allows authenticated users to craft parent-directory sequences that escape upload directories and unlink allow-listed fil...

CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

EUVD-2026-81683

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-93013 RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

CVE-2026-93013

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints. The root cause is missing path validation on the file_path parameter, which allows authenticated attackers to supply absolute file paths and read arbitrar...

CVE-2026-93013 RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

EUVD-2026-81682

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...