CVE-2025-70982

Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data...

CVE-2025-70982

Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data...

PT-2026-4805

Name of the Vulnerable Software and Affected Versions KubeVirt Containerized Data Importer CDI affected versions not specified Description A flaw exists in KubeVirt Containerized Data Importer CDI that allows a user to clone PersistentVolumeClaims PVCs from unauthorized namespaces. This can lead ...

GPAC buffer error vulnerability

GPAC is an open-source multimedia framework developed by GPAC. Versions of GPAC prior to 2.4.0 contained a buffer error vulnerability, which stemmed from out-of-bounds writing in the SRT subtitle import component...

CVE-2026-1418: Out-of-bounds Write

A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gftextimportsrtbifs of the file src/scenemanager/texttobifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has...

HUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCE

A user with administrative privileges can abuse the problemimportqduoj.php CGI script using a crafted zip file zip-slip to traverse backwards through the filesystem, then to the webroot, where they can extract a PHP file that spawns a shell to get full RCE in the context of the webserver. Module...

Moderate: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.1 security update

The multicluster engine for Kubernetes 2.10 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.10 images The multicluster engine for Kubernetes provides the foundational components that a...

CVE-2026-0911

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the actionimportmodule function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers, wi...

CVE-2026-0911 Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the actionimportmodule function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers, wi...

CVE-2026-0911

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the actionimportmodule function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers, wi...

CVE-2026-0911 Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the actionimportmodule function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers, wi...

CVE-2026-0911

CVE-2026-0911 concerns the Hustle – Email Marketing, Lead Generation, Optins, Popups WordPress plugin. The vulnerability allows authenticated users with low privileges (e.g., Subscriber+) to upload arbitrary files due to improper file type validation in action_import_module() across versions up t...

PT-2026-4616

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action import module function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers,...

Malicious code in tabletes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0e46bf0a52fee42a54e122a61b6da920b8d08234f109ab1da45c7f6c7042ef2 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

MAL-2026-469 Malicious code in cflashfiles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d8c5174968b7dedf000076201fe6446018aa61048b6a77fc8bc42e16bb796fd9 Malicious clone of legitimate fsspec package. The code was modified to exfiltrate specific files on import. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in cflashfiles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d8c5174968b7dedf000076201fe6446018aa61048b6a77fc8bc42e16bb796fd9 Malicious clone of legitimate fsspec package. The code was modified to exfiltrate specific files on import. --- Category: MALICIOUS - The campaign has clearly...

Malicious code in icloud-recovery (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3639028f2f9d36c20b55c655b1d71bc053827f4703e7954b12a4ec3da8edd8d2 On importing the module, the code exfiltrates text files, with the focus on configuration files --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-467 Malicious code in icloud-recovery (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3639028f2f9d36c20b55c655b1d71bc053827f4703e7954b12a4ec3da8edd8d2 On importing the module, the code exfiltrates text files, with the focus on configuration files --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in icloudprocessor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67b215e1995682b83e1afa8c297ecbdfe93d12db8cc11341b6bda84116d95814 During importing, the package starts a thread that exfiltrates user's files --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-449 Malicious code in icloudprocessor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67b215e1995682b83e1afa8c297ecbdfe93d12db8cc11341b6bda84116d95814 During importing, the package starts a thread that exfiltrates user's files --- Category: MALICIOUS - The campaign has clearly malicious intent, like...