CVE-2020-4450

creationtimestamp| type| source ---|---|--- 2026-07-18 15:00:05+00:00| seen| https://t.me/reverseame/153 2026-07-19 00:00:11+00:00| published-proof-of-concept| https://t.me/reverseame/153...

Metasploit Wrap Up: An HTTP to SMB relay plus Payload Improvements

Metasploit Wrap Up Housekeeping While the Metasploit Framework will be continuing its weekly release cadence, bringing you dear reader our latest content, the Weekly Wrap Up is being shifted to a bi-weekly cadence. The team is planning to use the additional time between posts to record demos of...

CVE-2026-48022: Cleartext Transmission of Sensitive Information

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact...

kumactl connects to control plane without verifying TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...

Malicious code in mw-server-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1401412848e55e1515db44b1f513ad6e39628f06c24c3b057a08448c9e8ee44c mw-server-util 2.0.1 ships a postinstall hook that runs mw.js, which reads os.hostname and os.userInfo and issues an HTTPS GET to a hardcoded Burp...

CVE-2026-55576

creationtimestamp| type| source ---|---|--- 2026-07-16 00:07:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpwwfqvfb2l...

PT-2026-93903

Name of the Vulnerable Software and Affected Versions CoreDNS versions prior to 1.14.7 Description CoreDNS contains an unauthenticated denial-of-service issue where the server parses attacker-controlled DNS section counts before validating the fixed header. This occurs within the DNS-over-HTTPS D...

CVE-2026-15925: Improper Validation of Certificate with Host Mismatch

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...

PT-2026-60670

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...

CVE-2026-52842

creationtimestamp| type| source ---|---|--- 2026-07-15 16:42:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp62iew3x2w 2026-07-15 19:15:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgm3qmkx2s...

Malicious Package

Overview gta5rp-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to t...

Malicious Package

Overview rusfish4-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to...

Malicious Package

Overview calc-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to the...

Malicious Package

Overview throne-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to t...

Uncaught Exception

Overview std/net is a Go standard library package std/net Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report:Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Remediation Upgrade std/net to...

CVE-2026-51105

creationtimestamp| type| source ---|---|--- 2026-07-14 15:43:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkcoi4r42e 2026-07-22 05:03:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kb2qcoe24...

XenServer Security Update for CVE-2026-42491

Severity: Medium Description of Problem An issue has been identified in the XenServer management API SDK that may allow an attacker on the management network who is able to intercept specific HTTPS requests within a higher-level operation to be able to act with the privileges of the intercepted...

PT-2026-58855

Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...

Improper Certificate Validation

Overview DIRAC is an interware, meaning a software framework for distributed computing. Affected versions of this package are vulnerable to Improper Certificate Validation in the process that downloads and executes the second stage pilot script over an unverified HTTPS connection. An attacker can...

PYSEC-2026-2424 compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

Summary The compliance-trestle library's remote fetching cache mechanism HTTPSFetcher and SFTPFetcher constructs the local cache file path from the URL path component without sanitizing path traversal sequences ../. When a remote OSCAL profile references a URL with traversal in its path, the HTTP...