ROOT-OS-DEBIAN-11-CVE-2024-44958 CVE-2024-44958 in rootio-linux - Patched by Root

Root has patched CVE-2024-44958 in the rootio-linux package for Root:Debian:11. Multiple fixed versions available...

EUVD-2026-43634

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional datapoint field in PublishValueRequest. When a request contains a valid signalid but omits datapoint, the server directly calls unwrap on request.datapoint,...

Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution

An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection. id:...

EUVD-2026-43623

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...

CVE-2026-62392

creationtimestamp| type| source ---|---|--- 2026-07-14 04:20:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqle5fo5ev23 2026-07-15 03:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnqj744cc2n 2026-07-21 08:46:15+00:00| seen|...

CVE-2026-62390

creationtimestamp| type| source ---|---|--- 2026-07-14 03:41:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqlbxpp4fp2j 2026-07-14 17:32:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmqeyjaxl2z 2026-07-15 02:37:06+00:00| seen|...

CVE-2026-15622 poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function getworkspacefile of the file executormanager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument userid can lead to authorization bypass. The attack may be launched...

CVE-2026-15622 poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function getworkspacefile of the file executormanager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument userid can lead to authorization bypass. The attack may be launched...

EUVD-2026-43599

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function getworkspacefile of the file executormanager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument userid can lead to authorization bypass. The attack may be launched...

CVE-2025-56364

A use of uninitialized value vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, where the GetDestinationGroupId.Value method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID...

CVE-2025-56364

The CVE-2025-56364 entry relates to the Matter SDK (connectedhomeip) before 1.4.0, where GetDestinationGroupId().Value() can be accessed without verifying existence, causing a crash (SIGABRT) and denial of service. Root cause: use of an uninitialized value; the affected component is the Matter SD...

PT-2026-57985

Name of the Vulnerable Software and Affected Versions Eclipse KUKSA Databroker version 0.6.1 Description The kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data point field in PublishValueRequest. If a request includes a valid signal id but omits data...

PT-2026-58848

Name of the Vulnerable Software and Affected Versions Matter SDK connectedhomeip versions prior to 1.4.0 Description A use of uninitialized value occurs when the GetDestinationGroupId.Value method is called without verifying if a value exists. This happens when an InvokeCommand is sent without...

CVE-2026-62195

creationtimestamp| type| source ---|---|--- 2026-07-13 23:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkt4djxzu2i 2026-07-15 09:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqoemwbh6j2f...

CVE-2026-56877

The CVE-2026-56877 issue affects Skillable/SCORM lab launch endpoint (scorm.skillable.com). The root cause is that the server does not validate the client-supplied userId against the authenticated session token, allowing an authenticated user to substitute arbitrary userId values. This can bypass...

CVE-2026-15597

CVE-2026-15597 affects SourceCodester Class and Exam Timetabling System (1.0/2.php). The vulnerability is an SQL injection in the /edit_exam2.php script triggered by manipulating the ID parameter, enabling remote attackers to potentially impact confidentiality, integrity, and availability. Techni...

CVE-2026-12536

creationtimestamp| type| source ---|---|--- 2026-07-13 21:41:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqknu2mb5q2x...

GHSA-V66C-278H-3VJ4 vulnerabilities

Vulnerabilities for packages: chromium...

MAL-2026-10478 Malicious code in @sectest429/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d The package advertises a single function module.exports = function helloname but ships a preinstall.js lifecycle script that runs automatically on np...

CVE-2026-57363

creationtimestamp| type| source ---|---|--- 2026-07-13 18:51:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkeecjaem2a 2026-07-14 01:19:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql224uclj2w 2026-07-16 08:15:38+00:00| seen|...