CVE-2026-47232

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

MAL-2026-13825 Malicious code in mnzjgxciwadk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb5ec6b21fbd7d0b720bf6dd7257a5b6e0e9428fe55d8197fccec53c79a662 The package contains a single file, index.html, which is also declared as the package main. The HTML presents a Cloudflare Turnstile-styled challenge...

MAL-2026-13838 Malicious code in unitel4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5370545a3cd79dd914fd2af5c469caf0f8942c74c14f760f34c3f6856e6648d Package contains only package.json and index.html, with main pointing at index.html. The HTML impersonates a Cloudflare 'Just a moment...'...

Malicious code in bgncvhferucfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1bf8639ccc5d2a70ae2e0ce754b76e1ca525699413f5d696289714005e86c57 The package's sole content is a single obfuscated HTML file declared as main. When loaded in a browser, the page renders a fake Cloudflare Turnstile...

Malicious code in bcnfjndwbkf2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1fc1ec45930a69372eadc47b662c5d82b247b5b4227feacda3d1c4302b4bf3 The package contains only index.html and declares main: 'index.html' with no scripts, no bin, and no JavaScript library surface. The HTML mimics a...

Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

K000162881: libcurl vulnerability CVE-2026-9547

Security Advisory Description When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific ke...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

EUVD-2026-57094

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

CVE-2026-18046

The CVE concerns the Cookie Consent WordPress plugin prior to 0.0.10. A REST route that stores the geolocation service license key does not correctly enforce its administrator-only capability check, falling back to an authentication-only gate. This allows any authenticated user (e.g., a subscribe...

CVE-2026-18046 Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

bind: bind9: Key Record using PRIVATEDNS algorithm may lead to exit

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key KEY, DNSKEY, etc.. That key must specify a PRIVATEDNS algorithm 253, and in the algorithm identifier,...

PT-2026-71083

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The token required decorator used by the Pub/Sub interface authenticated requests solely by matching the...

PT-2026-71123

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users...

Linux Distros Unpatched Vulnerability : CVE-2026-73281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use key...

PT-2026-71085

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base url for the openai compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/id/connection, causing...

CVE-2025-59321

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...

PT-2026-71077

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

PT-2026-71343

Name of the Vulnerable Software and Affected Versions Russh versions prior to 0.62.4 Description An unauthenticated SSH client can trigger a denial of service by sending an SSH MSG KEX ECDH INIT message containing a 32-byte all-zero Q C value. The Curve25519Kex::server dh function in...