CVE-2026-85022 langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

CVE-2026-85022 langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

CVE-2026-85022

A cross-site scripting (XSS) vulnerability affects the WebApp Sign-In component of langgenius dify 1.13.0 , specifically in the router.replace function within web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx. Manipulating the redirect_url argument enables remote attackers...

Node.js Module mariadb < 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3 Information Disclosure

The version of the MariaDB Connector/Node.js mariadb module detected on the host is prior to 3.2.4, 3.3.3, 3.4.6, or 3.5.3. It is, therefore, affected by an information disclosure vulnerability. When SSL/TLS is enabled but no CA or server certificate is provided, the connector validates the serve...

Linux Distros Unpatched Vulnerability : CVE-2026-59272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of...

Linux Distros Unpatched Vulnerability : CVE-2026-55857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog...

CVE-2026-84381

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

Linux Distros Unpatched Vulnerability : CVE-2026-84366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler...

GHSA-76G3-C3X4-CRVX Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Problem Scrapy’s S3DownloadHandler sends signed S3 requests over plaintext HTTP by default. A normal request like s3://bucket/key is converted into http://bucket.s3.amazonaws.com/key unless request.meta"issecure" is explicitly set. The generated request is then signed with configured AWS...

copyfail

CVE-2026-31431 — "Copy Fail" Safe Detection Script A read-only detection script for the Copy Fail Linux kernel local privilege escalation vulnerability. No exploit code. No AFALG socket opened. No files written outside /etc/modprobe.d only when you apply the mitigation manually. Background Copy...

CVE-2026-55857

A flaw was found in MariaDB Connector/J. A remote attacker or a man-in-the-middle server can exploit a vulnerability in the PAM dialog authentication mechanism. This flaw allows the attacker to coerce the connector into transmitting account passwords over an insecure connection when default...

CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical-

CVE-2026-21962-Oracle-HTTP-Server-WebLogic-Proxy-Plug-in-Critical- Oracle Fusion Middleware Oracle HTTP Server / WebLogic Server Proxy Plug-in has an easily exploitable, unauthenticated, network-reachable flaw allowing compromise over HTTP. Affected supported versions include 12.2.1.4.0,...

Ssh Mitm

SSH-MITM SSH-MITM is a man-in-the-middle SSH proxy for security audits and penetration testing. It supports intercepting SSH, SCP, and SFTP sessions, agent forwarding, port forwarding, and more. This repository was a mirror and is no longer updated. The official repositories are: GitHub:...

jsch

Fork of JSch-0.1.55 See original README Why should you use this library? As I explained in a blog post the main points are: OpenSSH has disabled ssh-rsa in release 8.8 per default and you need a library which supports rsa-sha2-256 and rsa-sha2-512. Drop in replacement: just change dependency...

CVE-2026-20355 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20355

CVE-2026-20355 affects the S/MIME decryption functionality of Cisco Secure Email . The root cause is insufficient validation of message integrity , allowing an unauthenticated, remote attacker to use a machine-in-the-middle technique to intercept and modify traffic between email gateways and reco...

EUVD-2026-70210

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

CVE-2026-20354 Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions S/MIME decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of messa...

ROOT-APP-NPM-CVE-2022-46175 CVE-2022-46175 in json5 - Patched by Root

Root has patched CVE-2022-46175 in the json5 package for Root:npm. Multiple fixed versions available...

CVE-2026-82884

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...