msmailprobe

msmailprobe Enumeración de Office 365 y Exchange Es ampliamente conocido que OWA Outlook Webapp es vulnerable a ataques de enumeración de usuarios basados en tiempo. Esta herramienta aprovecha todos los servicios conocidos, e incluso algunos menos conocidos, expuestos por instalaciones...

PT-2026-110411

Name of the Vulnerable Software and Affected Versions macrozheng mall versions prior to 1.0.4 Description A business logic error exists in the Payment Endpoint component within the AlipayServiceImpl.pay function of the com/macro/mall/portal/service/impl/AlipayServiceImpl.java file. A remote...

ROS-20261012-73-0207

The vulnerability in the kernel-lt is related to a single-bit offset error. Exploiting this vulnerability can allow an attacker to cause a service failure...

EulerOS 2.0 SP13 : xmlrpc-c (EulerOS-SA-2026-4115)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...

CVE-2026-77363: Origin Validation Error

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

TencentOS Server 3: postgresql:15 (TSSA-2026:1112)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1112 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2023-54407: Insertion of Sensitive Information into Log File

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback...

CVE-2026-9191: Origin Validation Error

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path...

ROS-20261012-73-0163

The vulnerability of the smcsetsockopt function in the net/smc/afsmc.c module of the SMC protocol family implementation in Linux’s kernel is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261012-73-0174

The vulnerability of the apparmor module in Linux operating systems is related to pointer arithmetic errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-110996

Name of the Vulnerable Software and Affected Versions Frappe versions 14.x through 14.44.9 Description An information disclosure issue exists where users with access to error logs can view secrets stored in local variables captured in tracebacks. A traceback is a report that provides the call sta...

ROS-20261012-73-0028

The vulnerability of the wdmincallback function in the drivers/usb/class/cdc-wdm.c file of the Linux operating system’s USB device driver framework is related to security configuration errors. Exploiting this vulnerability could allow an attacker to cause service failures...

TencentOS Server 3: xmlrpc-c (TSSA-2026:1119)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1119 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

EulerOS 2.0 SP13 : perl-DBI (EulerOS-SA-2026-4174)

According to the versions of the perl-DBI packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL...

EulerOS 2.0 SP13 : xmlrpc-c (EulerOS-SA-2026-4206)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...

EulerOS 2.0 SP11 : xmlrpc-c (EulerOS-SA-2026-4387)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...

Microsoft Exchange Server Memory Reclamation Code Execution

The vulnerability of Microsoft Exchange Server’s mail server is related to a memory reclamation error. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...

CVE-2026-41508: Protection Mechanism Failure

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...

CVE-2026-109332: Origin Validation Error

Network-AI npm network-ai before 5.15.2 contains an origin validation error in McpSseServer.handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with ...

CVE-2026-108362: Origin Validation Error

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...