CVE-2026-75509

A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption JOSE standards. A remote attacker could exploit a vulnerability in the JWTClaimsRegistry by crafting a JSON Web Token JWT with an array-valued issuer iss claim. This flaw allows the attacker to bypass the intende...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

CVE-2026-81827 Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input

Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Emailemail. That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process a...

lg-webos-kexec

lg-webos-kexec Boote einen eigenen Linux-Kernel auf einem gerooteten LG-webOS-TV per kexec — im RAM, ohne Secure-Boot-Bypass. Status: Work-in-Progress. Ein eigener Kernel kann gestaged werden und erreicht den Userspace, bleibt aber noch nicht als nutzbares OS aktiv. Zielgerät LG 50UP81009LR webOS...

CVE-2026-81753

Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to create or edit a note could store a crafte...

CVE-2026-74233

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-ECQP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain...

aegis-latent-core

Aegis Latent Core Gateway di governance e prove per applicazioni LLM multi-provider. Aegis Latent Core è un gateway compatibile con OpenAI che applica policy di richiesta, WAF, egress, rate-limit e controlli di sessione prima di inoltrare il traffico a un provider di modelli a monte. Per il...

CVE-2026-17562

Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0...

WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by Gaurav popalghat in WordPress Plugin Essential Addons for Elementor versions = 6.8.0...

CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...

CVE-2026-75975

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

CVE-2026-75931

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

CVE-2026-75899

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

CVE-2026-62384

A flaw was found in NLTK. The FramenetCorpusReader component is vulnerable to a symlink-based sandbox bypass. An attacker can exploit this by placing specially crafted symbolic links within a corpus subdirectory. These symlinks bypass path validation, allowing the attacker to read arbitrary XML...

Malicious code in ekx-report-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78 On import, the package runs a setup routine that reads a session credential from /tmp/.sandboxtoken and issues an authenticated GET to...

MAL-2026-14555 Malicious code in ekx-report-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a980e97d1539649ea4a9921cfeb308833c80e0832c1515f3f8e3a71d0b085b78 On import, the package runs a setup routine that reads a session credential from /tmp/.sandboxtoken and issues an authenticated GET to...

Security Bulletin: Multiple security vulnerabilities identified in Spring Framework version shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in Spring Framework shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-41841 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static...

CVE-2026-63379

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

msf-commander

⚔️ MSF Commander v4.0 Complete Offensive Security Arsenal...

CVE-2026-72848

A flaw was found in langchain-community. An attacker who controls or influences an ingested sitemap can bypass domain restrictions in the SitemapLoader component by pointing a nested sitemap entry at an internal address. This allows the server to fetch internal resources even when...