Linux Distros Unpatched Vulnerability : CVE-2026-49853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only...

netty-codec-http Arbitrary HTTP Request Injection

The vulnerability of the netty-codec-http module in the framework for developing network applications, servers, and clients using the Netty protocol is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTTP requests...

Microsoft .NET DoS

The vulnerability of the Microsoft .NET and Microsoft .NET Framework software platforms is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

RedAmon 6.0.2

An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merged patch, with human oversight at every...

bk-plugin-framework (>=2.3.0rc1, <=2.4.0rc0), bk-plugin-runtime (>=2.1.0rc1, <=2.2.0rc0) potentially affected by CVE-2026-50271 via ddtrace (0.14.1)

ddtrace PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - bk-plugin-framework =2.3.0rc1, =2.1.0rc1, =2.2.0rc0 Source cves: CVE-2026-50271 Source advisory: OSV:GHSA-MW54-J2V2-42HR...

CVE-2026-48795

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.prototype still caused lodash .set via @poppinss/utils to create...

EUVD-2026-44794

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::loadparam when Net::loadparam loads a malicious .param model file because th...

CVE-2026-50144 ncnn: Out-of-bounds heap write in ParamDict::load_param via unchecked negative parameter id

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::loadparam when Net::loadparam loads a malicious .param model file because th...

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things IoT botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model LLM, albeit with not so successful results. "While the AI complied with...

Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

CVE-2026-53633

A flaw was found in Vitest Browser Mode, a component of the Vitest testing framework. The cdp API exposed raw Chrome DevTools Protocol CDP methods without proper security restrictions. This vulnerability allows a remote attacker, with access to browser API metadata, to leverage CDP functions like...

RLSA-2026:39309 Low: capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fixes: capstone: Capstone: Memory corruption via unchecked vsnprintf return CVE-2025-68114 For more details about the security issues,...

.NET: .NET: Network Spoofing Vulnerability

A flaw was found in .NET. An authorized attacker can exploit this vulnerability by leveraging improper encoding or escaping of output. This allows the attacker to perform spoofing over a network, potentially deceiving users or systems into believing they are interacting with a trusted entity...

nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch

A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS Transport Layer Security hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security...

CVE-2026-61873 Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

OkoBot: new sophisticated malware framework targets cryptocurrency users

Introduction In January 2026, we identified multiple attacks involving unknown malware that captures the contents of cryptocurrency wallet windows. During the investigation, we reconstructed the complete infection chain, which consisted of four tightly linked stages initiated by the execution of...

Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell Local Exploitation Conditions Verification, Remed...

SUSE CVE-2026-54736

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first...

RHEL 9 : capstone (RHSA-2026:39309)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:39309 advisory. Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security...

Linux Distros Unpatched Vulnerability : CVE-2026-15747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates...