PT-2026-49811

In Write of msg to host buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-9258: Improper Certificate Validation

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier...

CVE-2026-12161: Improper Neutralization of Special Elements used in an OS Command

Improper input validation in the SSH Elevate Shell feature in Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alterna...

PT-2026-51413

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7 Description Nuxt contains three security issues related to client-navigation URL handling via the navigateTo and reloadNuxtApp functions. First, a server-side open redirect exists in...

Mozilla Firefox ESR < 115.37

The version of Firefox ESR installed on the remote Windows host is prior to 115.37. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-59 advisory. - Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and...

Universal Plug and Play Device Host Service Code Execution

The vulnerability of the Universal Plug and Play UPnP Device Host Service in Windows operating systems is related to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Universal Plug and Play Device Host Service Code Execution

The vulnerability of the Universal Plug and Play UPnP Device Host Service in Windows operating systems is related to data type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-50152

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.84.0 Description A Host-header parsing flaw in the LiteLLM proxy allows unauthenticated access to protected management routes. The authentication layer derives the effective route from request.url.path in the get...

Mozilla Thunderbird < 140.12

The version of Thunderbird installed on the remote Windows host is prior to 140.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-61 advisory. - Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox E...

CVE-2026-12162

The Devolutions Remote Desktop Manager version 2026.2.8 and earlier is affected by an improper host validation vulnerability in its social login autofill feature. An attacker can exploit this by using a crafted web entry that points to a provider lookalike domain , which may lead to the disclosur...

CVE-2026-12162

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain...

CVE-2026-12162

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain...

CVE-2026-12161

Devolutions Remote Desktop Manager versions 2026.2.5.0 through 2026.2.7.0 and 2026.1.23.0 and earlier are vulnerable to a command injection flaw. The root cause is improper input validation within the SSH Elevate Shell feature. An authenticated user with permissions to create or modify a shared S...

CVE-2026-9258

The CVE-2026-9258 entry describes Improper validation of SSH host keys in Canon EOS Network Setting Tool, affected in Version 1.5.0 or earlier. The issue is tied to a network-accessible vector with no user interaction required per CVSS, and could impact confidentiality, integrity, and availabilit...

CVE-2026-9258

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier...

CVE-2026-9258

Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier...

mlservicewrapper-host-http (>=0.1.0a0, <=0.5.0a0) potentially affected by CVE-2026-54282 via starlette (0.13.7)

starlette PYPI version 0.13.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - mlservicewrapper-host-http =0.1.0a0, =0.5.0a0 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

mlservicewrapper-host-http (>=0.1.0a0, <=0.5.0a0) potentially affected by CVE-2026-48817 via starlette (0.13.7)

starlette PYPI version 0.13.7 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - mlservicewrapper-host-http =0.1.0a0, =0.5.0a0 Source cves: CVE-2026-48817 Source advisory: OSV:GHSA-X746-7M8F-X49C...

Malicious code in yunxin-overmind-comment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc On npm install, the package's scripts.postinstall runs src/postinstall.js, which spawns a detached Node child that collects the installer's hostname,...

MAL-2026-5833 Malicious code in yunxin-overmind-comment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57551a10d99024d1d12c7f2e349e6557613ed3a5e036bf45d71129d501fbbabc On npm install, the package's scripts.postinstall runs src/postinstall.js, which spawns a detached Node child that collects the installer's hostname,...