PYSEC-2026-3506 PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

DiscordApproval accepts unrelated channel messages as dangerous-tool approvals Summary praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose text is classified as approval, such as yes. The decision is...

PYSEC-2026-3458 ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals

DiscordApproval accepts unrelated channel messages as dangerous-tool approvals Summarypraisonai.bots.DiscordApproval approves a pending dangerous tool call when itsees any later non-bot message in the configured Discord channel whose text isclassified as approval, such as yes.The decision is not...

ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers

Cybersecurity researchers have shed light on a large-scale campaign that has turned compromised GitHub repositories into distributed attack infrastructure designed to target cPanel and WebHost Manager WHM instances. The activity involves malicious Packagist development versions spanning 10 packag...

Exploit for CVE-2026-63766

CVE-2026-63766 — GPT-SoVITS Unauthenticated OS Command Injecti...

Millions of cars could be tracked and unlocked by a hidden security flaw

A car alarm vendor's coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don't even know they have one installed. The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm buil...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2025-32432 Craft CMS PoC Single-target proof-of-concept...

Exploit for Incorrect Authorization in Canonical Ubuntu_Linux

CVE-2021-3493 — Ubuntu OverlayFS Local Privilege Escalation A...

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco Talos has discovered a new Rust-based remote access trojan RAT we call "msaRAT" attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: "msaOpen," "msaClose," "msaError," and "msaMessage". msaRAT is implemented using the Tokio asynchronous...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Apache HTTP Server Exploit This repository con...

Exploit for CVE-2026-56121

CVE-2026-56121 — Feast Registry Unauthenticated RCE dill.load...

CVE-2026-16287

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs

RefluXFS, a Linux kernel flaw disclosed on July 22 and tracked as CVE-2026-64600, lets an unprivileged local user overwrite root-owned files on an XFS filesystem and gain persistent root access. Qualys said default installations of Red Hat Enterprise Linux and its derivatives, Fedora Server, and...

CVE-2026-16287

CVE-2026-16287 affects Pardus-update (TÜBİTAK BİLGEM) with OS command injection via offline update. Affected: pardus-update versions before 0.7.0 (starting at 0.6.6). Root cause: improper neutralization of special OS command elements. Impact: high for confidentiality, integrity, and availability;...

CVE-2026-16287

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

CVE-2026-16287 Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

EUVD-2026-47933

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

CVE-2026-16287 Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management MDSM products, including a critical flaw that has come under active exploitation in the wild. The security flaw, tracked as CVE-2026-16232 CVSS score: 9.3, is an...