509809 matches found
CVE-2026-44210
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...
Exploit for Improper Handling of Case Sensitivity in Flowiseai Flowise
Flowise CVE-2026-58057 - Windows Remote Code Execution Exploit...
GO-2026-5989 Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh
When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map. An unauthenticated remote client can grow the state storage, bounded by...
CVE-2026-44210
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...
CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...
GO-2026-5675 Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph
The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster...
ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories
Most of this week's trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every...
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection,...
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data large...
Email threat landscape: Q2 2026 trends and insights
In this article 1. Tycoon2FA Q2 disruption impact 2. QR code phishing attacks 3. CAPTCHA-gated phishing tactics 4. Malicious payloads 5. Business email compromise 6. Microsoft Teams threats 7. Notable phishing campaigns 8. Mitigation and protection guidance 9. Indicators of compromise IOCs The...
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Summary Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, becaus...
2026-07-tare-nightbox33-cloud
Tare contest details - Join Sherlock Discordhttps://discor...
CVE-2026-16733
A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...
CVE-2026-16735
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...
CVE-2026-16735
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...
CVE-2026-16735
The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...
EUVD-2026-48283
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...
CVE-2026-16735 release-it conventional-changelog Changelog File index.js writeChangelog os command injection
A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...
CVE-2026-16733 bahmutov find-cypress-specs Branch index.js shell.exec os command injection
A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...
CVE-2026-16733
A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...