CVE-2026-64564

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

CVE-2026-72915: Exposure of Sensitive Information to an Unauthorized Actor

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collectionscontroller.rb to access personally identifying information about another local user in...

The vulnerability of the IP Protection component in the Firefox web browser and the Thunderbird email client allows attackers to access confidential data.

The vulnerability of the IP Protection component in the Firefox web browser and the Thunderbird email client relates to the disclosure of information. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

metabigor v2.2.0

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

ownsite-assessor

OwnSite Assessor Authorized defensive security assessment...

Server-Side Request Forgery (SSRF)

ip-address is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to isInSubnet suppressing special-use address classification when the input CIDR mask is shorter than the reference range, allowing an attacker to use a suffix such as /0 to bypass checks like isPrivate and...

Malicious code in titan-exchange-shared-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6 [email protected] is a dependency-confusion reconnaissance package. package.json declares a postinstall script node index.js...

RLSA-2026:51295 Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv6: ioam: fix heap buffer overflow in ioam6filltracedata CVE-2026-43186 Bug Fixes and Enhancements: kernel panics caused by NULL pointer dereferences within octeonepvf rhel-10.2.z...

CVE-2026-48097

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

CVE-2026-48098

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

CVE-2026-48098 NexTOR IP Changer Unsafely Uses sudo and shell=True

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

EUVD-2026-54604

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

CVE-2026-48098 NexTOR IP Changer Unsafely Uses sudo and shell=True

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

CVE-2026-48097

NexTor IP Changer (CLI tool) is affected by a PATH-based command execution vulnerability caused by unsafe use of shell=True, where executable resolution via PATH allows an attacker with control of the execution environment to place malicious executables earlier in PATH, enabling execution of atta...

CVE-2026-48097 NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

CVE-2026-48097 NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

Webkit-exploit

webkit with RCE only NO KERNEL YET, it's working on 9.00 for n...

MAL-2026-13604 Malicious code in tailwindcss-motion-advanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b8426c39ffcba11d95e8ede8085ce260dbcf8527544ce9ca3a1d7a59618f0eb On require of the package's main entry, lib/utils.min.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org,...

Malicious code in blekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...