3930 matches found
CVE-2026-15037
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
CVE-2026-15037
Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...
CVE-2026-14551
The servereye client also known as sensorhub, technically ClientAgentContainerService versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery EmergencyRecoveryService.exe, running as SYSTEM, periodically monitors the directory...
Important: kernel-livepatch-6.12.80-105.147
Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.80-105.147 Issue Correction: Please ensure you have live patching enabled. Run dnf update...
Important: kernel-livepatch-6.18.35-68.129
Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.18.35-68.129 Issue Correction: Please ensure you have live patching enabled. Run dnf update...
Fedora 43 : libtiff (2026-feac063d56)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-feac063d56 advisory. updated to 4.7.2, fixes security issues Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...
PYSEC-2026-2919 PraisonAI: Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS
Summary The AgentOS deployment platform exposes a GET /api/agents endpoint that returns agent names, roles, and the first 100 characters of agent system instructions to any unauthenticated caller. The AgentOS FastAPI application has no authentication middleware, no API key validation, and default...
PYSEC-2026-1461 Indico vulnerable to Cross-Site Scripting via LaTeX math code
Impact There is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Patches You should to update to Indico 3.3.8 as soon as possible. See the docs for instructions on how to update. Workarounds Only let trustworthy users create content on...
Security Bulletin: Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect IBM Cloud Pak System[CVE-2023-38265, CVE-2023-38005]
Summary Improper Access Control and Exposure of Information Through Directory Listing vulnerabilities affect Cloud Pak System respectively. IBM Cloud Pak System could allow an authenticated user to perform unauthorized tasks due to improper access controls , and disclose folder location informati...
EUVD-2025-210296
An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which fixes the issue...
Security Bulletin: SSLv2 DROWN Vulnerability (CVE-2016-0800)
Question Security Bulletin: SSLv2 DROWN Vulnerability CVE-2016-0800 "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM Aspera","Component":"","Platform":"code":"PF025","label":"Platform Independent","Version":"All Versions","Edition":"","Line of...
CVE-2026-12216
The CVE-2026-12216 entry concerns svaarala duktape up to 2.99.99. The vulnerability occurs in duk_api_bytecode.c and is triggered by manipulating the argument count_instr, leading to memory corruption. Exploitation requires local access, and a public exploit/public disclosure has been made. No re...
PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections
Large Language Models LLMs are rapidly evolving into agentic systems that interact with external tools and environments, introducing new security risks such as indirect prompt injection attacks through untrusted external sources. Existing defenses mainly focus on blocking malicious content at...
EUVD-2026-35187
Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of anothe...
PT-2026-47184
Name of the Vulnerable Software and Affected Versions rclone versions 1.46.0 through 1.74.2 Description When the remote control API is enabled and the --rc-serve flag is used without HTTP authentication, the software accepts unauthenticated GET and HEAD requests to paths formatted as...
Kernel-Exploit-Dojo-127
Kernel-Exploit-Dojo-127 CTF kernel exploitation notes, PoCs,...
Kernel-Exploit-Dojo-243
Kernel-Exploit-Dojo-243 CTF kernel exploitation notes, PoCs,...
Kernel-Exploit-Dojo-962
Kernel-Exploit-Dojo-962 CTF kernel exploitation notes, PoCs,...