csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

CVE-2026-28327 SolarWinds Dameware DLL Hijacking Vulnerability

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges...

CVE-2026-28327 SolarWinds Dameware DLL Hijacking Vulnerability

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges...

CVE-2026-28327

SolarWinds Dameware is affected by a DLL hijacking vulnerability (CWE-427) occurring exclusively during installations . Exploitation requires local machine access and administrative privileges . While the specific component or file is not named, the vulnerability results in a High severity impact...

Roundcube Webmail Project Roundcube Webmail authorization issue vulnerability

The Roundcube Webmail project contains an authorization issue vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from improper authentication in multi-host installations; when logging in using alias addresses, rcubeuser::query fails to restrict matching...

CVE-2026-77427

The self-hosted file manager FileRise versions 3.9.0 through 3.22.0 is vulnerable to an insecure default cryptographic key fallback in manual installations. If the PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key are missing, the system activates a published legacy compatibility key. An at...

CVE-2026-82348

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users ar...

EUVD-2026-85338

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

PT-2026-96660

Name of the Vulnerable Software and Affected Versions Hostel plugin for WordPress versions prior to 1.1.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with Administrator-level access to perform Stored Cross-Site Scripting. This issue occurs via the...

CVE-2026-75031

In the interchange/interchange project, a critical remote code execution RCE vulnerability was found in the “quick question” admin feature. In default installations arbitrary Perl code can be injected and executed server-side by unauthenticated users. The Perl code normally runs within a Safe...

PT-2026-95734

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions prior to 2.4.13 Description Insufficient input sanitization and output escaping in the admin settings allow authenticated attackers with administrator-level permissions or higher to perform Stored Cross-Site...

CVE-2026-18306 GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-2487: Improper Neutralization of Input During Web Page Generation

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-12477: Improper Neutralization of Input During Web Page Generation

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-51200

IBM webMethods Integration on prem 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data...

PT-2026-65391

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-14819: Improper Neutralization of Input During Web Page Generation

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

Malicious Package

Overview devplatform-rest-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in @cloudplatform-single-spa/installations (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

VulnCheck KEV: CVE-2026-48611

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations...