PT-2026-82900

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: acquire ARP hw source only after skb realloc The pskb may pull called by batadv get vid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid a...

PT-2026-82904

In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix OOB read in hid get report for numbered reports When a caller passes a size of 0 to hid report raw event for a numbered report, the function originally called hid get report before performing any size validation...

PT-2026-82970

In the Linux kernel, the following vulnerability has been resolved: perf tools: Use perf env get cpu topology in machine resolve machine resolve accesses env-cpual-cpu.socket id after checking al-cpu = 0 and env-cpu != NULL, but without validating al-cpu against env-nr cpus avail. Since al-cpu...

PT-2026-82834

In openNDS before 11.0.0, the client params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

PT-2026-82965

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvm translate vncr can't resolve PFN kvm handle vncr abort assumes that s1 walk result conveys an abort when kvm translate vncr returns -EFAULT. This is not always the case as it's possible to...

PT-2026-82862

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-82952

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

PT-2026-83114

cPanel and Plesk both patched a root escalation on Aug 27. Same headline, opposite response. cPanel CVE-2026-65643: an account that can add a parked or addon domain writes arbitrary files and runs code as root. Routine feature, every shared server. No mitigation. Patch. Plesk CVE-2026-67394: need...

PT-2026-82940

In the Linux kernel, the following vulnerability has been resolved: cxl/fwctl: Fix fortify panic Fix a runtime assertion in cxlctl get supported features. Fortify complains that it is potentially overflowing the entries array per counted by lenum entries. Quiet the false positive by initializing...

CVE-2023-43318

CVE-2023-43318 JetStream Smart Switch - TL-SG2210P v5.0/ Controllo di accesso improprio / CVE-2023-43318 + Credit: Shahnawaz Shaikh, Ricercatore di sicurezza presso Cybergate Defense LLC + Twitter Fornitore: Tp-Link http://tp-link.com Prodotto: JetStream Smart Switch - TL-SG2210P Tipo di...

CVE-2025-46204

Descrizione Unifiedtransform v2.0 è vulnerabile a un controllo di accesso non corretto. Qualsiasi utente studenti e insegnanti può accedere e modificare i dettagli del corso tramite gli endpoint /course/edit/id. Questa funzionalità è destinata esclusivamente all'uso amministrativo. Sfruttando...

CVE-2025-46203

Description Unifiedtransform v2.0 è vulnerabile a un controllo degli accessi errato. Qualsiasi utente studenti e insegnanti può accedere e modificare le registrazioni degli studenti tramite gli endpoint /students/edit/id. Questa funzionalità è destinata esclusivamente all'uso amministrativo. Lo...

CVE-2026-61802 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

CVE-2026-61802 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

CVE-2026-61802 Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

CVE-2026-61802

Wazuh (open-source XDR/SIEM platform), versions 4.14.0 through 4.14.6 , contains a configuration-redaction gap: the GET /cluster/local/config endpoint is gated only by cluster:read permission and lacks the mask_sensitive_config decorator that all sibling config-read endpoints carry. As a result, ...

CVE-2023-7028

CVE-2023-7028lab Implementazione e sfruttamento della vulnerabilità di account takeover CVE-2023-7028 relativa agli articoli settimanali GO-TO CVE dell'undicesima settimana. Questo repository contiene un setup Docker e uno script Python per testare la vulnerabilità CVE-2023-7028 in GitLab. Lo...

CVE-2023-20273

CVE-2023-20273 CVE-2023-20273 PoC Exploit Utilizzo root@kitploit: usage: exploit.py -h -t URL -u Username -p Password -c Command | -r -dest Outfile -www | -tcp | -null -ip LocalIP -port LocalPort -fs filesystem -path filepath -operation operationtype -v -q CVE-2023-20273 Exploit PoC options: -h,...

CVE-2026-61783

Wazuh versions 4.14.0 through 4.14.6 contain an RBAC logic flaw in the mask_sensitive_config() decorator. The gate that determines whether sensitive values are masked checks only whether a manager:update_config or cluster:update_config rule exists, without evaluating whether that rule's effect is...

CVE-2026-61783 Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...