InnoShop 授权问题漏洞

InnoShop is an open-source e-commerce system based on Laravel 11, developed by InnoShop. Versions of InnoShop prior to 0.7.8 had authorization-related vulnerabilities. These vulnerabilities stemmed from improper authentication practices in the InstallServiceProvider::boot function found in the...

RHCOS 4 : OpenShift Container Platform 4.18.35 (RHSA-2026:3875)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3875 advisory. - golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 - golang: net/url: Memory exhaustion in query...

Wireshark 2.2.x < 2.2.16 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.2.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.2.16 advisory. - In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the Bazaar protocol dissector could...

Multiple Cisco Products Snort 3 Multiple DoS (cisco-sa-snort3-multi-dos-XFWkWSwz)

According to its self-reported version, Cisco Secure Firewall Threat Defense FTD Software is affected by multiple vulnerabilities. - Multiple Cisco products are affected by vulnerabilities in the Snort 3 detection engine that could allow an unauthenticated, remote attacker to cause the Snort 3...

Dell Alienware Command Center < 6.13.8.0 Multiple Vulnerabilities (DSA-2026-192)

The version of Dell Alienware Command Center AWCC installed on the remote host is prior to 6.13.8.0. It is, therefore, affected by multiple vulnerabilities: - An execution with unnecessary privileges vulnerability in the AWCC. A low privileged attacker with local access could potentially exploit...

ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories

The internet is noisy this week. We are seeing some wild new tactics, like people using fake cell towers to send scam texts, while some developers are accidentally downloading tools that peek into their private files during a simple install. It is definitely a busy time to be online. Security is...

Lobster_pro 代码问题漏洞

Lobsterpro is a middleware platform developed by the German company Lobster, used for enterprise data integration and process orchestration. Versions of Lobsterpro prior to 4.12.6-GA contained code vulnerabilities. These vulnerabilities stemmed from weaknesses in the XML parser’s functionality,...

ROS-20260430-73-0015

Vulnerability in golang related to flaws in authorization mechanism. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

Amazon Linux 2 : LibRaw, --advisory ALAS2-2026-3258 (ALAS-2026-3258)

The version of LibRaw installed on the remote host is prior to 0.19.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3258 advisory. An integer overflow vulnerability exists in the deflatedngloadraw functionality of LibRaw. A specially crafted malicious...

Medium: credentials-fetcher

Issue Overview: Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler cmd/compile. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption in programs compiled with...

Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2026-1606)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1606 advisory. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compiler cmd/compile. As a result, the compiler would allow for invalid indexing to...

Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-112 (ALASDOCKER-2026-112)

The version of containerd installed on the remote host is prior to 2.1.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-112 advisory. Arithmetic over induction variables in loops were not correctly checked for underflow or overflow in the Go compil...

Cursor AI Agent Wipes PocketOS Database and Backups in 9 Seconds

PocketOS founder says Cursor AI agent deleted its production database in 9 seconds after misusing a root API token, exposing major Railway security flaws...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling...

CVE-2026-41952

Local privilege escalation due to improper input validation. The following products are affected: Acronis DeviceLock DLP Windows before build 9.0.93212, Acronis Cyber Protect Cloud Agent Windows before build 42183...

USN-8222-1: OpenSSH vulnerabilities

Christos Papakonstantinou discovered that the OpenSSH scp tool incorrectly handled the legacy scp protocol -O option. This could result in certain files being installed setuid or setgid, contrary to expectations. CVE-2026-35385 Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell...

Jenkins GitHub Branch Source Plugin 安全漏洞

Jenkins GitHub Branch Source Plugin is an open-source plugin for Jenkins that provides continuous integration capabilities, enabling discovery of code hosting platforms and the selection of build branches. The Jenkins GitHub Branch Source Plugin versions 1967.vdead580c1aba and earlier contain...

Jenkins Script Security Plugin 安全漏洞

The Jenkins Script Security Plugin is an open-source plugin developed by Jenkins that provides security controls and permission checks for automated script execution. The Jenkins Script Security Plugin versions 1399.ve6a66547f6e1 and earlier contain security vulnerabilities. These vulnerabilities...

PT-2026-38907

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw in the RxRPC networking subsystem occurs when a socket buffer carrying a page-cache reference reaches the authentication verification path. The kernel performs in-place decryption...

Acronis Cyber Protect Cloud Agent和Acronis DeviceLock DLP 安全漏洞

Acronis Cyber Protect Cloud Agent and Acronis DeviceLock DLP are both products of the Swiss company Acronis. Acronis Cyber Protect Cloud Agent is a cloud-based agent. Acronis DeviceLock DLP is a terminal security protection system designed to control peripheral access and prevent data breaches...