CVE-2026-22238 Administrator Account Creation Vulnerability in BLUVOYIX

The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable admin API to create a new user with admin privileges. Successful...

CVE-2025-68957

Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability...

Patch Tuesday, January 2026 Edition

Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft's most-dire "critical" rating, and the company warns that attackers are already exploiting one of the bugs fixed today...

The vulnerability of the Nimes Backup and Recovery software for automated backup and data restoration operations lies in the insufficient checking of incoming requests. This allows a hacker to execute an SRF attack.

The vulnerability of the Nimes Backup and Recovery software for automated backup and data recovery operations is related to insufficient checking of incoming requests. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack remotely...

KLA91057 DoS vulnerabilities in Wireshark

Multiple vulnerabilities were found in Wireshark. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in Wireshark dissector can be exploited remotely to cause denial of service. 2. Denial of...

PT-2026-20864

Name of the Vulnerable Software and Affected Versions go-chi/chi versions 5.2.2 and later Description An Open Redirect issue exists in the RedirectSlashes function of the go-chi/chi web framework. This flaw allows attackers to create malicious URLs that redirect users to arbitrary external sites,...

MiracleLinux 3 : xulrunner-1.9.2.4-9.0.1.AXS3 (AXSA:2010-369:02)

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2010-369:02 advisory. XULRunner provides the XUL Runtime environment for Gecko applications. Security issues fixed with this release: CVE-2008-5913 An unspecified function...

The vulnerability of the Apache Struts software platform, related to the lack of authenticity checking for XML documents, allows attackers to execute XXE attacks.

The vulnerability of the Apache Struts software platform is related to the lack of authenticity checking for XML documents. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

The vulnerability of the HTTP.sys driver on Windows operating systems, which allows attackers to increase their privileges

The vulnerability of the HTTP.sys driver on Windows operating systems is related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Kerberos protocol for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Kerberos protocol for Windows operating systems is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Safe Access function in operating systems like SRM allows attackers to gain access to and modify files on a web page’s structure without any protection.

The vulnerability of the Safe Access function in SRM operating systems is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to and modify files with restricted access...

CVE-2025-15492

A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/mapping/GroupMemberMapper.xml. Performing a manipulation of the argument searchWord results in sql injection. It is possible to initiate the attack remotely. Th...

CVE-2026-0851

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2022-50898 NanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated)

NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper...

Microsoft Patch Tuesday for January 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for January 2026, which includes 112 vulnerabilities affecting a range of products, including 8 that Microsoft marked as "critical". In this month's release, Microsoft observed one of the included "important" vulnerabilities, CVE-2026-20805, as...

CVE-2026-20868

Heap-based buffer overflow in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to execute code over a network...

Astra Linux – Vulnerability in binutils

A vulnerability was discovered in GNU Binutils 2.43 and is classified as problematic. The affected component is the function linkorderscan in the file ld/ldelfgen.c. Manipulation of this function leads to a memory leak. The attack can be launched remotely. The complexity of such an attack is quit...

KryptoPilot: An Open-World Knowledge-Augmented LLM Agent for Automated Cryptographic Exploitation

Capture-the-Flag CTF competitions play a central role in modern cybersecurity as a platform for training practitioners and evaluating offensive and defensive techniques derived from real-world vulnerabilities. Despite recent advances in large language models LLMs, existing LLM-based agents remain...

PT-2026-2418

Name of the Vulnerable Software and Affected Versions AimOne Video Converter version 2.04 Build 103 Description AimOne Video Converter version 2.04 Build 103 contains a buffer overflow in its registration form, leading to application crashes and a denial of service. An attacker can create a...

CVE-2026-22212 TinyOS <= 2.1.2 Stack-Based Buffer Overflow in mcp2200gpio

TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility. The vulnerability is caused by unsafe use of strcpy and strcat functions when constructing device paths during automatic device discovery. A local attacker can exploit this by...