CVE-2026-41940 WebPros cPanel and WHM Authentication Bypass via Login Flow

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel...

Linux nf_flow_table_free Heap Buffer Overflow DoS

The vulnerability of the nfflowtablefree function in Linux operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to compromise the accessibility of protected information...

PT-2026-35936

Name of the Vulnerable Software and Affected Versions cPanel and WHM versions prior to 11.110.0.97 cPanel and WHM versions prior to 11.118.0.63 cPanel and WHM versions prior to 11.126.0.54 cPanel and WHM versions prior to 11.132.0.29 cPanel and WHM versions prior to 11.134.0.20 cPanel and WHM...

VideoFlow Digital Video Protection DVP Cross-Site Request Forgery Vulnerability

VideoFlow Digital Video Protection DVP is a video security system provided by VideoFlow Corporation in the United States. It offers features for video content encryption and digital copyright protection. Version 2.10 of VideoFlow Digital Video Protection DVP contains a cross-site request forgeing...

Static Attribution of Android Residential Proxy Malware Using Graph Kernels

Android residential proxy applications represent a growing class of potentially-unwanted programs PUPs that covertly route third-party traffic through end-user devices, enabling ad fraud, credential abuse, and evasion of geolocation controls by sophisticated threat actors. Attributing an unknown...

PT-2026-35993

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting a cross-site request forgery flaw in the web management interface. Attackers with valid credentials can...

CVE-2026-41377

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

codex-solidity

⛓️ Codex Solidity — Smart Contract & Protocol Audit Agent Imp...

PT-2026-35682

A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality of the file packages/scaffold-mcp/src/server/index.ts of the component write-to-file Tool. The manipulation of the argument file path results in path traversal. The attack may b...

CVE-2026-41377: Not Failing Securely

OpenClaw before 2026.3.31 contains a fail-open vulnerability in the plugin installation flow where security scan failures do not block installation. Attackers can exploit scan failures to install untrusted plugins when operators proceed despite visible scan warnings...

Security Bulletin: Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id

Summary Langflow OSS is affected by an insecure direct object reference vulnerability in its Monitor API due to missing authorization checks. Although these endpoints require authentication, they fail to verify ownership of the provided flowid, allowing any authenticated user to access or...

CVE-2026-5938

Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service...

CVE-2026-31680

A flaw was found in the Linux kernel. A local user can exploit a race condition in the IPv6 flow label handling, specifically during the teardown of exclusive flow label options. This can lead to a use-after-free vulnerability when a concurrent reader accesses freed option state, triggering a...

PT-2026-111258

Уязвимость функции nvec rx completed файла drivers/staging/nvec/nvec.c ядра операционной системы Linux связана с реализацией некорректного потока управления. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информац...

PT-2026-35400

Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service...

CVE-2026-5938: Insufficient Control Flow Management

Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service...

denuOwO-hypervisor-vulnerabilities

DenuOwO SVM/VMX Hypervisor — 6 Vulnerabilities PoC + Analysis...

BinExploit-Bench

BinExploit-Bench: Binary Exploitation Capability Benchmark for...

arm-64-exploit-demo

ARM64 Buffer Overflow Exploit Demo A from-scratch demonstrati...

The Vehicle May Be Sick: Denial of Diagnostic Services by Exploiting the CAN Transport Protocol

Vehicle diagnostics has become essential for detecting in-vehicle errors and ensuring safety. While the Unified Diagnostic Services UDS protocol is widely adopted for diagnostic operations, it relies on the ISO 15765-2 standard as the transport protocol over the Controller Area Network CAN, which...