MINI-4X27-WGMX-XGWX

Bulletin has no description...

BELL-CVE-2026-64409

Bulletin has no description...

BELL-CVE-2026-64475

Bulletin has no description...

BELL-CVE-2026-64246

Bulletin has no description...

BELL-CVE-2026-64208

Bulletin has no description...

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Summary Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant -b ':pass'. The empty-password variant bypasses that fix. CVE-2026-40884 CVE-2026-40884 GHSA-c29w-qq4m-2gcv, Apr 13 2026 reported the...

GHSA-RJRW-MJQ6-HPMM goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Summary Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant -b ':pass'. The empty-password variant bypasses that fix. CVE-2026-40884 CVE-2026-40884 GHSA-c29w-qq4m-2gcv, Apr 13 2026 reported the...

CVE-2026-62325

Goshs 2.1.3–2.1.4 SFTP authentication bypass vulnerability arises from sftpserver/sftpserver.go password handler: it only checks Username != "" && Password != "", which allowed unauthenticated access when running with -b 'admin:' -sftp and without -fkf. The issue effectively lets an attacker acce...

EUVD-2026-50079

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

CVE-2026-62325 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

CVE-2026-62325 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

CVE-2026-62325 goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

RHSA-2026:45114 Red Hat Security Advisory: kernel security update

Bulletin has no description...

CVE-2026-66729

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...

EUVD-2026-49358

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...

CVE-2026-66729 facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...

CVE-2026-66729

The CVE-2026-66729 entry concerns facil.io (versions up to 0.7.6). A vulnerability in the multipart MIME body parser allows an unauthenticated attacker to crash the server by sending a Content-Disposition header with an empty field name, triggering a uint32 wraparound in http_mime_parser.h that l...

MINI-386H-W82G-56WG

Bulletin has no description...

MINI-GVX3-G995-HF75

Bulletin has no description...

CVE-2026-14289 WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file...