EUVD-2025-210894

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

CVE-2025-64059

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

CVE-2025-64059

Grav 1.7.50.2 allows administrators to inject JavaScript through the Home Page editor , a potential stored XSS vector. However, the practical relevance is disputed : since admins already possess the ability to modify templates, install plugins, and upload other executable content, the additional ...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

PT-2026-89304

A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve an arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI CLI HOME...

GHSA-VV4J-M4VR-F3G6 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

PT-2026-89214

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

MAL-2026-16039 Malicious code in service-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffce66fb482d77c6fcfcf9cf3ab50c0de30f856921f4a90f9de969212a2687f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in service-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffce66fb482d77c6fcfcf9cf3ab50c0de30f856921f4a90f9de969212a2687f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Project-01-Cybersecurity-Home-Lab

Project 1 — Cybersecurity Home Lab Project Overview This...

SUSE-SU-2026:23454-1 Security update for systemd

This update for systemd fixes the following issue: Security issue fixed: - CVE-2026-16742: systemd-homed: local privilege escalation due to missing home record signature verification on the authentication path bsc1271444. Non security issue fixed: - systemd-resolved fails to start due to write...

MAL-2026-15917 Malicious code in @crysnovax/baileys (npm)

@crysnovax/baileys is a renamed fork of the Baileys WhatsApp Web library. On every successful connection connection.update with connection === 'open', wired in lib/Socket/socket.js it silently makes the user's own authenticated WhatsApp account follow two channels controlled by the publisher,...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

CVE-2026-16742

A flaw was found in systemd-homed. A local, logged-in user can exploit a missing signature verification in the authentication path when processing home records. This vulnerability allows the user to add arbitrary system groups to their account, which can lead to local privilege escalation and...

NetAlertX v26.9.0

NetAlertX - Network Visibility & Asset Intelligence Framework 📷 Click for more screenshots | | ---|---|--- | | | | Head to https://netalertx.com/ for even more gifs and screenshots 📷. NetAlertX is a network visibility and asset intelligence platform for homelabs, IT teams, MSPs, and distributed...

yolobox v0.19.4

root@kitploit: ██╗ ██╗ ██████╗ ██╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ╚██╗ ██╔╝██╔═══██╗██║ ██╔═══██╗██╔══██╗██╔═══██╗╚██╗██╔╝ ╚████╔╝ ██║ ██║██║ ██║ ██║██████╔╝██║ ██║ ╚███╔╝ ╚██╔╝ ██║ ██║██║ ██║ ██║██╔══██╗██║ ██║ ██╔██╗ ██║ ╚██████╔╝███████╗╚██████╔╝██████╔╝╚██████╔╝██╔╝ ██╗ ╚═╝ ╚═════╝ ╚══════╝...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.31 packages and security update

Red Hat OpenShift Container Platform release 4.21.31 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 packages and security update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...