SUSE CVE-2026-94284

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients...

CVE-2026-84990 ntopng: Missing Authorization on System Configuration Backup Download and Listing

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

EUVD-2026-83984

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/listavailablebackups.lua and scripts/lua/rest/v2/get/system/configurations/downloadbackup.lua allow any authenticated non-admin user to list and download...

CVE-2026-52742 GoCD is vulnerable to historical server configuration API authorization bypass

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/ expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include...

Reverse-Engineering Flock Cameras

Hackers captured a Flock camera and got a look alternate link at the software: While much of the automatic license plate reader's ALPR most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects...

CVE-2026-80230

A flaw was found in libcurl, a client-side URL transfer library. When public key pinning is configured, but standard peer verification is explicitly disabled, libcurl incorrectly allows connections to proceed without enforcing the public key pinning. This bypass enables unauthenticated connection...

CVE-2026-94381

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permission...

EUVD-2026-83906

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permission...

CVE-2026-94381

CVE-2026-94381 affects MISP versions prior to 2.5.47 , where the updateLoginTime function could restore a user's full account permissions after authenticating with a read-only API key . This means a holder of a read-only key could escalate to write, delete, or even administrator privileges on a s...

CVE-2026-94381 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permission...

CVE-2026-94381 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permission...

CVE-2026-94381 MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permission...

WordPress APCu Manager plugin < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution vulnerability

Unauthenticated Stored XSS via Cache Key Pollution vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin APCu Manager versions 4.5.0...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

MAL-2026-16310 Malicious code in npx-test-ma980 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adfd1e5f7cc282648da56cdf50ac9c3cb27d6165fa4a3f8f3625b4a0c2694be6 package.json declares a bin entry whose key contains shell metacharacters and a chained command: "tool & calc.exe": "./run.js". On Windows, npm's bin...

Exploit for Authentication Bypass by Primary Weakness in Haxx Curl

CVE-2026-8932 PoC Proof-of-concept reproduction of CVE-2026...

EUVD-2026-83808

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/networktools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possibl...

PT-2026-96095

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permission...