Malicious code in @brick-v2/table (npm)

@brick-v2/table is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

CVE-2026-107824: Missing Authentication for Critical Function

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

Apache HTTP Server 2.4.49 Path Traversal

Apache HTTP Server version 2.4.49 contains a path traversal flaw that can disclose files outside the document root and, with CGI enabled, allow command execution. This proof of concept provides a vulnerable container and reproduction commands. https://packetstorm.news/download/235010...

Linux Distros Unpatched Vulnerability : CVE-2026-78669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS...

Aiohttp HTTP client Host Certificate DOSS

The vulnerability of the Aiohttp HTTP client is related to the lack of checking host certificate data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Aiohttp HTTP Client Resource Leak DoS

The vulnerability of the Aiohttp HTTP client is related to errors during resource release. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Aiohttp HTTP Client Source Verification Confidential Data Access

The vulnerability of the Aiohttp HTTP client is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...

PT-2026-109152

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

PT-2026-117592

Summary pyLoad ships the WindowsPhoneNotify addon, whose send method opens an HTTP connection to a host taken directly from the plugin's pushurl configuration value. A user holding the standard non-admin SETTINGS permission can set pushurl and pushid and enable the addon through the web API, sinc...

Linux Distros Unpatched Vulnerability : CVE-2026-107399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in...

Linux Distros Unpatched Vulnerability : CVE-2026-107714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agentresponseredirect treats redirects as same-origin...

PT-2026-109276

Name of the Vulnerable Software and Affected Versions x64dbg-MCP Server versions prior to 1.1 Description x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes debugger functionality over HTTP and Server-Sent Events SSE. The server listens on 0.0.0.0 by default...

Linux Distros Unpatched Vulnerability : CVE-2026-97032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.4:CLSA-2026:1791552138)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791552138 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

HTTP/3 Server Data Compromise

The vulnerability of HTTP/3 server-side software such as HAProxy is related to errors in processing input data length parameters. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...

Progress Telerik Fiddler Classic < 6.0.20262.10021 Multiple Vulnerabilities

The version of Progress Telerik Fiddler Classic installed on the remote Windows host is prior to 6.0.20262.10021. It is, therefore, affected by multiple vulnerabilities: - An insufficient integrity check on external helper tools allows a local low-privileged attacker to replace a helper executabl...

Golang net/http DoS

The vulnerability of the net/http component in the Golang programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service failures...

Cisco NX-OS Software NX-API RCE (cisco-sa-napi-rce-r2shwu2j)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS...

Oracle Linux 8 : ruby:2.5 (ELSA-2026-73519)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-73519 advisory. - Fix integer overflow in searchinrange function in regexec.c CVE-2019-19012. Resolves: RHEL-87505 - Fix REXML ReDoS vulnerability. CVE-2024-49761...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22035-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22035-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs...