CVE-2025-46018-CSC-Pay-Mobile-App-Payment-Authentication-Bypass

CVE-2025-46018 – Обход аутентификации платежей в мобильном приложении CSC Pay Резюме В мобильном приложении CSC Pay версии 2.19.4 была обнаружена уязвимость обхода аутентификации платежей. Она позволяла злоумышленнику инициировать платеж, отключить Bluetooth в определённый момент процесса и...

PrintNightmare

RCE del servizio Windows Print Spooler CVE-2021-1675 PrintNightmare Come disabilitare il servizio Print Spooler ? CMD Shell net start | findstr -i "spooler" net stop spooler REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v "Start " /t REGDWORD /d "4" /f PowerShell Get-Service -Name...

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan RAT called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government...

EUVD-2026-66560

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

PT-2026-82220

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

CVE-2021-1675

CVE-2021-1675 - Mitigazione PrintNightmare DSC PowerShell Kougyoku Gentou | 1 luglio 2021 CVE-2021-1675 è una vulnerabilità critica di esecuzione remota di codice e di escalation dei privilegi locali, soprannominata "PrintNightmare". La mitigazione consiste nel disabilitare il servizio Print...

SUSE CVE-2026-46241

In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on registration failure Make sure to disable and free the interrupts in case controller registration fails to avoid a potential use-after-free and resource leak. This issue was flagged by Sashiko...

squid security update

7:3.5.20-17.0.11.13 - Security update for CVE-2026-32748 CVE-2026-33526 Orabug: 39230173 7:3.5.20-17.0.9.13 - Fixes CVE-2025-62168, squid: Squid vulnerable to information disclosure via - authentication credential leakage in error handling Orabug: 38587551 7:3.5.20-17.0.7.13 - Fixes CVE-2025-5457...

CVE-2026-43983

Pocket ID’s OIDC refresh token flow (createTokenFromRefreshToken in oidc_service.go) fails to re-check the user’s current authorization state before issuing new tokens prior to version 2.6.0. This can allow token refresh after authorization revocation, post-account disabling, or after removal fro...

CVE-2026-43983 Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function oidcservice.go validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state befor...

CVE-2026-6703 Responsive Blocks <= 2.2.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions

The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticat...

CVE-2026-4401 Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disabling

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the actionshandler and bulkactionshandler methods in class-dlm-downloads-path.php in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it...

CVE-2021-27139

An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to extract information from the device without authentication by disabling JavaScript and visiting /info.asp...

CVE-2026-33619

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side request forgery issue in the optional scheduler's webhook delivery path. When a task is submitted to POST /tasks with a user-controlled callbackUrl, the v0.8.3...

CVE-2026-23332 cpufreq: intel_pstate: Fix crash during turbo disable

In the Linux kernel, the following vulnerability has been resolved: cpufreq: intelpstate: Fix crash during turbo disable When the system is booted with kernel command line argument "nosmt" or "maxcpus" to limit the number of CPUs, disabling turbo via: echo 1...

CVE-2026-24137 sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client pkg/tuf/client.go supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from...

CVE-2019-25235

Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system...

EulerOS Virtualization 2.13.1 : python-urllib3 (EulerOS-SA-2025-2563)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all...

Security Bulletin: CVE-2025-46801 - Pgpool-II Authentication Bypass

Summary Pgpool-II contains an authentication bypass vulnerability that can be exploited under certain conditions. If an attacker exploits the vulnerability they may be able to log in to the system as an arbitrary user, which could allow them to read or tamper with data in the database, and/or...

IBM Transformation Extender Advanced Logout Without Disabling Session Vulnerability

IBM Transformation Extender Advanced A data transformation, validation and standardization tool software from International Business Machines Corporation. IBM Transformation Extender Advanced suffers from a Logout Without Disabling Session vulnerability, which can be exploited by an attacker to...