CVE-2026-27730

esm.sh is a no-build content delivery network CDN for web development. Versions up to and including 137 have an SSRF vulnerability CWE-918 in esm.sh’s /https fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypass...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2022-20775link is external Cisco Catalyst SD-WAN Path Traversal Vulnerability CVE-2026-20127link is external Cisco Catalyst SD-WAN Controller and Manager...

PT-2026-21989

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server Liberty affected versions not specified Description IBM WebSphere Application Server Liberty may provide weaker than expected security. The issue could potentially impact the security posture of the application...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-25108link is external Soliton Systems K.K. FileZen OS Command Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-2782

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two security flaws impacting Roundcube webmail software to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities in question are listed below - CVE-2025-49113 CVSS...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-49113link is external RoundCube Webmail Deserialization of Untrusted Data Vulnerability CVE-2025-68461link is external RoundCube Webmail Cross-site Scripti...

GHSA-J9WF-6R2X-HQMX Centrifugo v6.6.0 dependency vulnerabilities

Summary Centrifugo v6.6.0 binary is compiled with Go 1.25.5 and statically links github.com/quic-go/webtransport-go v0.9.0, having 7 known CVEs Go standard library — compiled with Go 1.25.5: | CVE | Severity | CVSS | Fixed In | |-----|----------|------|----------| | CVE-2025-68121 | CRITICAL | 10...

CLSA-2026-1771501223 curl: Fix of CVE-2025-15079

CVE-2025-15079: fix accepting hosts not present in the specified knownhosts during SSH-based SCP/SFTP transfers when global knownhosts contained them restrict host verification to the specified knownhosts file...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2021-22175link is external GitLab Server-Side Request Forgery SSRF Vulnerability CVE-2026-22769link is external Dell RecoverPoint for Virtual Machines RP4VMs Us...

PT-2026-20308

Name of the Vulnerable Software and Affected Versions HPE Aruba Networking 5G Core versions affected versions not specified Description An issue exists in the API error handling of an HPE Aruba Networking 5G Core server API that could allow an unauthenticated remote attacker to obtain sensitive...

PT-2026-20266

Name of the Vulnerable Software and Affected Versions Datart version 1.0.0-rc.3 Description An information exposure issue exists in Datart version 1.0.0-rc.3. Authenticated attackers can potentially access sensitive data through a custom H2 JDBC connection string. The issue involves the potential...

CVE-2026-26273

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve...

PT-2026-8219

Name of the Vulnerable Software and Affected Versions SilverFox affected versions not specified Description A proof of concept has been published demonstrating exploitation in the wild. The Silverfox Group is actively exploiting this issue to terminate antivirus processes. The vulnerable driver i...

Known affected by Account Takeover via Password Reset Token Leakage

Summary A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's...

CVE-2026-26273

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve...

CVE-2026-26273 Known affected by Account Takeover via Password Reset Token Leakage

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-1731link is external BeyondTrust Remote Support RS and Privileged Remote Access PRA OS Command Injection Vulnerability These types of vulnerabilities are...

Linux Distros Unpatched Vulnerability : CVE-2026-26081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - haproxy - None Ubuntu Linux - crash via INITIAL packet for the NEWTOKEN format CVE-2026-26081 Note that Nessus relies on the presence of the...

Known 授权问题漏洞

Known is a known open-source social publishing platform in the United States. Versions prior to 1.6.3 of Known had an authorization issue vulnerability. This vulnerability stemmed from the leakage of the password reset token through a hidden HTML input field on the password reset page, which coul...