CVE-2023-26258-ArcServe

The TL; DR; If you are in the network you can scan for instances configured by default using ArcServeRadar.py. I tried to port it to C but couldn't, feel free to do it if you know how : c:\Users\vagrant\Desktoppython ArcServeRadar.py "Ethernet 2" 6969 192.168.56.20 -= ArcServe Finder - @TheXC3LL ...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663

Vyper versions 0.4.0b1 through 0.5.0b1 are vulnerable to a name shadowing issue affecting unfoldable constants and omitted default arguments from imported modules. The root cause is that the parse_Name function resolves these names within the using function's scope instead of at the point of decl...

ktor-xxe-poc

CVE-2023-45612: JetBrains Ktor XXE Proof of Concept This repository contains a vulnerable Ktor server to demonstrate the XML External Entity XXE injection vulnerability identified in CVE-2023-45612. The vulnerability exists in Ktor versions before 2.3.5 when the ContentNegotiation plugin is used...

CVE-2026-103301

The Payment Gateway for Telcell WordPress plugin (versions before 2.0.5 ) is vulnerable to unauthenticated payment confirmation forgery . The root cause is an empty-by-default merchant secret used to sign incoming payment notifications, which the plugin fails to properly verify. An unauthenticate...

CVE-2026-103301 Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret

The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as pai...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

CLSA-2026-1792525290 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792525288 TuxCare security update for @babel/plugin-proposal-export-default-from (2 CVEs)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792525287 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792525284 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

Apache Axis2 Default Login

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. id: CVE-2010-02...

CLSA-2026-1792457914 TuxCare security update for @babel/plugin-syntax-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792457916 TuxCare security update for @babel/plugin-syntax-export-default-from (2 CVEs)

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792457909 TuxCare security update for @babel/plugin-syntax-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792457908 TuxCare security update for @babel/plugin-syntax-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

PT-2026-118297

Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...