Exploit for CVE-2026-19900

CVE-2026-19900 LB-LINK X-PRO Authentication Bypass and RCE via...

CVE-2026-61608 SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...

CVE-2026-19302

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-80838

In the Linux kernel, the following vulnerability has been resolved: vxlan: keep the last remote linked during FDB flush A non-nexthop FDB entry is expected to have at least one remote while it remains reachable through the FDB hash table. A filtered bulk flush violates this invariant when every...

CVE-2026-19302

IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to information disclosure via improper symbolic link validation in the GitExtractor component. While the component validates repository URLs to block local clones, it does not inspect the cloned tree for symbolic links. An attacker-con...

CVE-2026-19302 Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-85676

Dub contains an open redirect vulnerability in the redirurl query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redirurl parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Du...

CVE-2026-85676

Dub , a link-shortening service, contains an open redirect vulnerability in its redir_url query parameter. The parameter is accepted on every short link without validation or domain-allowlist enforcement, allowing attackers to append an arbitrary external URL and redirect visitors through the tru...

EUVD-2026-71132

Dub contains an open redirect vulnerability in the redirurl query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redirurl parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Du...

CVE-2026-85676 Dub Open Redirect via Unrestricted redir_url Parameter

Dub contains an open redirect vulnerability in the redirurl query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redirurl parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Du...

Malicious Package

Overview dajouka-sclas-rc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview cz-conventional-changelog-comet-prompts-link is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

EUVD-2026-70768

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

EUVD-2026-70818

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...

EUVD-2026-70766

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...

EUVD-2026-70819

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...

PT-2026-85671

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...

CVE-2026-61608: Insufficient Session Expiration

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...

CVE-2026-85676: URL Redirection to Untrusted Site

Dub contains an open redirect vulnerability in the redirurl query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redirurl parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Du...

The vulnerability of the qrtr_port_remove() function in the net/qrtr/af_qrtr.c module, which supports Qualcomm IPC cores in the Linux operating system, allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the qrtrportremove function in the net/qrtr/afqrtr.c module, which supports Qualcomm IPC cores in the Linux operating system, is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...