CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

Exploit for Integer Overflow or Wraparound in Google Android

CVE-2025-48595 — Android Framework Integer Overflow Vulnerabil...

K000163055: OpenSSH vulnerabilities CVE-2026-35386 and CVE-2026-35414

Security Advisory Description CVE-2026-35386 In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in...

CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

EUVD-2026-64752

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China,...

CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth , allowing an attacker within Bluetooth range to modify Wi-Fi configuration parameters (SSID, PSK, MAC, regulatory country code, channel). By overwriting the Wi-Fi PSK with a known value, an attacker can connect to the dro...

CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

MAL-2026-14401 Malicious code in multyproccess (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553 The package's setup.py overrides the install and develop cmdclass to base64-decode a bundled request/.payload file and launch it via...

Malicious code in multyproccess (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553 The package's setup.py overrides the install and develop cmdclass to base64-decode a bundled request/.payload file and launch it via...

Security update for the Linux Kernel (Live Patch 42 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.172 fixes various security issues: The following security issues were fixed: CVE-2023-53995: net: ipv4: fix one memleak in inetdelifa bsc1269284. CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk...

Exploit for Deserialization of Untrusted Data in Facebook React

Next.js React Server Components RCE Exploit Exploits CVE-2025...

Sakura Editor vulnerable to OS command injection

Overview Sakura Editor provided by Sakura Editor Development Community has a functionality "Open Terminal". It does not neutralize the string which represents the current directory the directory where the editing file is located. OS command injection CWE-78 - CVE-2026-59561 Impact If a victim use...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

Security update for Multi-Linux Manager Client Tools - Monitoring stack

This update fixes the following issues: grafana updated from version 11.6.14+security04 to version 12.4.5: Security fixes: CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints bsc1271331 - version 12.4.4 CVE-2025-12141: Fixed information leakage...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

BIT-VALKEY-2026-63639 Valkey: UAF in stream deserialization may lead to remote code execution

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

NextGen Mirth Connect - Remote Code Execution

Mirth Connect, by NextGen HealthCare, is an open source data integration platform widely used by healthcare companies. Versions prior to 4.4.1 are vulnerable to an unauthenticated remote code execution vulnerability id: CVE-2023-37679 info: name: NextGen Mirth Connect - Remote Code Execution...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. id: CVE-2019-2725 info: name: Oracle WebLogic...