📄 SiYuan 3.7.1 Authentication Bypass / Arbitrary File Write

A proof of concept exploit for a SiYuan version 3.7.1 authentication bypass arbitrary file read and write vulnerability. SiYuan kernel versions 3.7.0 through 3.7.1 contain a missing authorization vulnerability in the Publish reverse proxy where anonymous RoleReader requests are permitted to acces...

RHEL 10 : p11-kit (RHSA-2026:49668)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49668 advisory. The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides...

RHEL 8 : hplip (RHSA-2026:48959)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:48959 advisory. The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project HPLIP, which provides drivers for Hewlett-Packard printer...

RHEL 10 : libtiff (RHSA-2026:49671)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49671 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff:...

RHEL 7 : gstreamer-plugins-bad-free (RHSA-2026:49517)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49517 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer-plugins-bad-free package...

RHEL 10 : gstreamer1-plugins-good (RHSA-2026:49508)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49508 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a...

RHEL 10 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 8.1.7 (RHSA-2026:49700)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49700 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This...

RHEL 9 : xorg-x11-server (RHSA-2026:49608)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49608 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user...

RHEL 9 : nodejs:24 (RHSA-2026:47057)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:47057 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Exodia

Exodia Autonomous AI-driven penetrat...

Malicious code in tailwindcss-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e01f26860cd01782ea3614f8dd2d144ced75af610edac79984c24d67dee41d8a index.js hides a base64-encoded payload after a long run of tab characters and executes it via evalatob... at module load, so any require/import of t...

MAL-2026-11487 Malicious code in tailwindcss-anim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e01f26860cd01782ea3614f8dd2d144ced75af610edac79984c24d67dee41d8a index.js hides a base64-encoded payload after a long run of tab characters and executes it via evalatob... at module load, so any require/import of t...

GHSA-93WV-JW9V-4972 vulnerabilities

Vulnerabilities for packages: keycloak-fips, seata, celeborn, camunda-zeebe, elasticsearch, kayenta, metabase, druid, spark-fips, zipkin, neo4j, kserve-modelmesh, opensearch, kafbat-ui-fips, spark-kubernetes-operator-fips, apache-camel-karavan-devmode, localstack, spark, kayenta-fips, keycloak...

CVE-2026-56819 vulnerabilities

Vulnerabilities for packages: keycloak-fips, seata, celeborn, camunda-zeebe, elasticsearch, kayenta, metabase, druid, spark-fips, zipkin, neo4j, kserve-modelmesh, opensearch, kafbat-ui-fips, spark-kubernetes-operator-fips, apache-camel-karavan-devmode, localstack, spark, kayenta-fips, keycloak...

Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard , the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware...

Exploit for CVE-2026-14361

CVE-2026-14361 Consul Template's writeToFile helper opened an...

OS Command Injection

github.com/kube-logging/logging-operator is vulnerable to OS Command Injection. The vulnerability is due to the Fluentd configuration renderer FluentRender writing unescaped CRD strings such as Flow recordtransformer.records values directly into fluent.conf, which allows an attacker with permissi...

CVE-2026-54787 vulnerabilities

Vulnerabilities for packages: goreleaser, crossplane, kyverno-notation-aws, trivy-operator, flux-source-controller, ko, policy-controller, zot, falcoctl, tekton-chains, tkn, kyverno, kubescape, spire-server, neuvector-sigstore-interface, zarf, trivy, aactl, skaffold...

GHSA-WQQC-JJCQ-VFXM vulnerabilities

Vulnerabilities for packages: goreleaser, crossplane, kyverno-notation-aws, trivy-operator, flux-source-controller, ko, policy-controller, zot, falcoctl, tekton-chains, tkn, kyverno, kubescape, spire-server, neuvector-sigstore-interface, zarf, trivy, aactl, skaffold...

CVE-2026-54787 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, falcoctl-fips, goreleaser, trivy-operator-fips, kubescape, trivy, policy-controller-fips, spire-server, tbot, docker-fips, kubescape-server-fips, falcoctl, skaffold-fips, ko-fips, cosign-fips, flux-source-controller-fips, spire-server-fips,...