Powertek Firmware <3.30.30 - Authorization Bypass

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

XWiki Platform Distribution Flavor Main - Cross-Site Scripting

XWiki Platform Distribution Flavor Main versions prior to 17.6.0 are vulnerable to reflected cross-site scripting XSS due to improper sanitization of user-supplied input in the extensionId parameter. An attacker can exploit this issue by injecting malicious JavaScript, which will be executed in t...

CVE-2026-77710

misp-stix (the MISP STIX import library) is vulnerable to STIX2 parser confusion and mass assignment (CWE-915, CWE-807). The import logic selected between the internal MISP parser and the external STIX parser based on untrusted metadata—MISP-specific tool labels (STIX2) or document title (STIX1)—...

CVE-2026-77710 STIX2 Parser Confusion and Mass Assignment Allow Unauthorized MISP Attribute Metadata Injection in misp-stix library

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import. The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itsel...

ROOT-OS-UBUNTU-2204-CVE-2023-53093 CVE-2023-53093 in linux - Patched by Root

Root has patched CVE-2023-53093 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

CVE-2026-70782

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

EUVD-2026-61733

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

EUVD-2026-61139

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with...

BIT-DISTRIBUTION-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared dige...

PT-2026-77777

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor...

DEBIAN-CVE-2026-72030

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Reject an invalid concurrent positioning ranges count atadevconfigcpr takes the number of range descriptors from buf0 of the concurrent positioning ranges log up to 255, which the device reports independently of...

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: dive, crane, vault-csi-provider-fips, net-kourier, sbom-convert, packer-fips, smarter-device-manager-fips, age, smarter-device-manager, container-object-storage-interface, envconsul-fips, cloud-provider-azure-fips, ratify-fips, tigera-operator,...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: dive, crane, vault-csi-provider-fips, net-kourier, sbom-convert, packer-fips, smarter-device-manager-fips, age, smarter-device-manager, container-object-storage-interface, envconsul-fips, cloud-provider-azure-fips, ratify-fips, tigera-operator,...

GO-2025-3749 vulnerabilities

Vulnerabilities for packages: dive, authservice, cortex, flannel-cni-plugin, vault-csi-provider-fips, sbom-convert, postgres-operator, smarter-device-manager-fips, age, smarter-device-manager, cloud-provider-azure-fips, cluster-autoscaler, tigera-operator, x509-certificate-exporter-fips,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-azure-fips, policy-controller, openbao-fips, cortex, kubernetes-dashboard-auth, kargo, kubernetes-dashboard-auth-fips, minio-operator-fips, spire-server, terraform-provider-azapi, skaffold-fips, trufflehog-fips, argo-cd-fips,...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: authservice, openbao-fips, cortex, kargo, argo-events-fips, cloud-sql-proxy-fips, cloudflared, packer-fips, postgres-operator, weaviate, age, cloud-provider-azure-fips, cluster-autoscaler, tigera-operator, hugo-extended, x509-certificate-exporter-fips, k6, helm-fips,...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: dive, authservice, openbao-fips, cortex, kargo, nri-kubernetes, argo-events-fips, cloud-sql-proxy-fips, cloudflared, packer-fips, postgres-operator, smarter-device-manager-fips, weaviate, smarter-device-manager, cloud-provider-azure-fips, cluster-autoscaler,...

CLEANSTART-2026-BY65203 Security fixes in distribution 3.1.1-r1

Package distribution version 3.1.1-r1 fixes 6 vulnerabilities: CVE-2026-39828, ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv, ghsa-x527-x647-q7gg...

SonicWall SMA1000 Server-Side Request Forgery / Remote Command Execution

This Metasploit module exploits a server-side request forgery vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to access the internal Erlang distribution service. After authenticating using the known Erlang distribution cookie, the module invokes os:cmd/1 through Erlang RPC to...