PT-2026-80960

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted...

PT-2026-80947

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted inpu...

MiracleLinux 9 : vim-8.2.2637-26.el9_8.13.ML.1 (AXSA:2026-1631:22)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1631:22 advisory. vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious...

SPIP X-Spip-Filtre Unauthenticated Remote Code Execution

This Metasploit module exploits a PHP function-call injection in SPIPs template engine. The analyseresultatskel function extracts the X-Spip-Filtre: ... patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter...

mvt

Mobile Verification Toolkit !IMPORTANT Abbiamo recentemente unito il ramo "v3". Questo ha introdotto modifiche sostanziali. Se dipendevi dall'output di mvt in altri script, potrebbero essersi rotti. Maggiori dettagli: https://github.com/mvt-project/mvt/issues/757 Mobile Verification Toolkit MVT è...

CVE-2026-33937

CVE-2026-33937 — Handlebars.js AST Injection RCE Betroffen sind die Handlebars.js-Versionen 4.0.0 bis 4.7.8. CVSS-Score: 9.8 Kritisch. Übersicht CVE-2026-33937 ist eine Type-Confusion-Schwachstelle in Handlebars.js. Die Funktion Handlebars.compile akzeptiert als Eingabe sowohl eine...

cyclonedx-cli

root@kitploit: / / / / / \ |/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / // // / // / // / / / / / // / | / // // / /, ///// /////|| /// // Usage: cyclonedx command options Options: --version Show version information -?, -h, --help Show help and usage information Commands: add...

Security update for the Linux Kernel (Live Patch 34 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.133 fixes various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1269284. CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk...

Aegis aegis-v0.13.0-alpha

AEGIS OS-level oversight for AI coding agents Open-source monitor that shows what AI coding agents actually do on your machine — at the OS level, no agent hooks required. AEGIS sees every AI agent on your machine — even ones that don't cooperate. It is an independent, OS-level observer that watch...

Dark-Moon v1.3.1

The Open-Source AI-Powered Autonomous Penetration Testing Platform The only autonomous AI pentester where the model never sees your real IPs, hostnames or credentials. As featured in Help Net Security · Cyber Security News · SecurityBrief · LinuxLinks · IT Brief · ChannelLife Full Documentation ·...

CVE-2026-78141

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

Scrapling v0.4.15

Effortless Web Scraping for the Modern Web العربيه | Español | Português Brasil | Français | Deutsch | 简体中文 | 日本語 | Русский | 한국어 Selection methods · Fetchers · Spiders · Proxy Rotation · CLI · MCP Scrapling is an adaptive Web Scraping framework that handles everything f...

CVE-2026-78141 Tenda CH22 exeCommand formexeCommand command injection

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-78141

A command injection vulnerability exists in Tenda CH22 firmware version 1.0.0.1 . The flaw resides in the function formexeCommand within the file /goform/exeCommand , where unsanitized manipulation of the argument cmdinput allows an attacker to inject arbitrary commands. The attack is remotely ex...

CVE-2026-78141 Tenda CH22 exeCommand formexeCommand command injection

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

kata-containers v4.1.0

Kata Containers Welcome to Kata Containers! This repository is the home of the Kata Containers code for the 2.0 and newer releases. If you want to learn about Kata Containers, visit the main Kata Containers website. Introduction Kata Containers is an open source project and community working to...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

Malicious code in cryptgraphy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7f362d84083dd8b3398e66da8abc40aecb79fd1d7b1b42d32938f9089bd3d2 The package impersonates the cryptography/boto3 ecosystem via a typosquatted name and falsified metadata author 'AWS Support Team' , url...

MAL-2026-14388 Malicious code in cryptgraphy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7f362d84083dd8b3398e66da8abc40aecb79fd1d7b1b42d32938f9089bd3d2 The package impersonates the cryptography/boto3 ecosystem via a typosquatted name and falsified metadata author 'AWS Support Team' , url...

Security update for the Linux Kernel (Live Patch 52 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.209 fixes various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1269284. CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk...