CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

About Remote Code Execution - Zimbra Collaboration (CVE-2026-73570) vulnerability

About Remote Code Execution - Zimbra Collaboration CVE-2026-73570 vulnerability. Zimbra Collaboration is a collaboration software suite that includes a mail server and web client. In terms of functionality, it is comparable to Microsoft Exchange. The vulnerability allows an unauthenticated attack...

Misconfiguration-Manager — Updated!

Misconfiguration Manager Remediation Quick Start 1. Review the list of known and documented Attack Techniques and corresponding Defense Techniques to identify issues that may be present in your environment and how to remediate them Refer to this introduction to the project 2. Run ConfigManBearPig...

Claude-ExternalPentest

External Penetration Test agents for Claude Code A Claude C...

CVE-2026-16658

A flaw was found in the community.proxmox Ansible collection's proxmoxpctremote connection plugin. The buildpctcommand method constructs a pct exec command string using unquoted string concatenation and passes it to the Proxmox host's shell via Paramiko. Shell metacharacters in the command such a...

CVE-2026-13732

A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main functio...

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2023-31308

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

EUVD-2026-68727

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-53508

oasdiff (a Go command-line tool and package for comparing OpenAPI specs, hosted at github.com/oasdiff/oasdiff ) failed to enforce the --allow-external-refs=false flag on the git-revision load path (rev:path form, e.g. main:openapi.yaml). From version 1.13.2 through 1.18.0 , external $refs were re...

CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

tfc — Updated!

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

CVE-2023-31308

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

CVE-2023-31308

A malicious virtual function can invoke certain command handlers in the SMU , causing a denial of service due to an out-of-bounds memory read . Per AMD's CVSS 3.1 rating, the impact is LOW (3.3) with a local attack vector requiring low privileges and no user interaction, affecting only availabili...

CVE-2023-31308

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

EUVD-2023-60610

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read...

CVE-2026-79748

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

Malicious code in tailwindcss-forms-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...

MAL-2026-15636 Malicious code in tailwindcss-forms-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...