1511 matches found
CVE-2026-30916
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.9, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information. This impacts users of Shescape that configure their shell to point to a file on disk...
China-Linked Hackers Hit Qatar with Backdoor Disguised as War News
China-linked hackers targeted Qatar using fake war news lures to spread PlugX backdoor malware and spy on military and energy sectors...
Signal and WhatsApp accounts targeted in phishing campaign
Dutch intelligence services AIVD and MIVD warn that Russian state‑backed hackers are running a large‑scale campaign to break into Signal and WhatsApp accounts of high‑value targets. The targets are said to be senior officials, military personnel, civil servants, and journalists. The attackers are...
CVE-2026-30916
REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: Further investigation determined that the software behavior described did not falls within the project's threat model. See https://github.com/github/advisory-database/pull/7206 for more information...
CVE-2026-30916 Shescape has possible misidentification of shell due to link chains
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.9, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information. This impacts users of Shescape that configure their shell to point to a file on disk...
EUVD-2026-10424
Shescape is a simple shell escape library for JavaScript. Prior to 2.1.9, an attacker may be able to bypass escaping for the shell being used. This can result, for example, in exposure of sensitive information. This impacts users of Shescape that configure their shell to point to a file on disk...
UltraVNC 代码问题漏洞
UltraVNC is an open-source remote terminal control software developed by UltraVNC Inc. for the Windows platform. Version 1.6.4.0 of UltraVNC has a code vulnerability, which stems from an uncontrolled search path issue in the cryptbase.dll library...
Withdrawn Advisory: Shescape has possible misidentification of shell due to link chains
Withdrawn Advisory This advisory has been withdrawn because it falls outside the https://github.com/ericcornelissen/shescape/blob/a2544a1c78cae19d0e81a485b997bf0b0fcc2c12/SECURITY.mdthreat-model. This link is maintained to preserve external references. Original Description Impact This impacts use...
CVE-2026-29609
OpenClaw CVE-2026-29609 affects OpenClaw versions prior to 2026.2.14. The vulnerability resides in the fetchWithGuard function, which allocates the entire response payload in memory before enforcing maxBytes limits. Remote attackers can trigger memory exhaustion by serving oversized responses wit...
CVE-2026-30823
creationtimestamp| type| source ---|---|--- 2026-03-05 21:31:35+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-cwc3-p92j-g7qm 2026-03-07 08:07:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mghep67nmd2k 2026-03-07...
Pakistan-Linked APT36 Floods Indian Govt Networks With AI-Made ‘Vibeware’
Bitdefender research reveals Pakistani group APT36 is using AI-generated vibeware and trusted cloud services like Google Sheets to target Indian officials...
Malicious Package
Overview xpack-sui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday
A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerability in question is CVE-2026-21513 CVSS score: 8.8, a high-severity security feature bypass affecti...
CVE-2026-3164
creationtimestamp| type| source ---|---|--- 2026-03-02 02:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mg25teeoam2m...
CVE-2026-27804 Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.3 and 9.1.1-alpha.4, an unauthenticated attacker can forge a Google authentication token with alg: "none" to log in as any user linked to a Google account, without knowing...
CVE-2026-25959
creationtimestamp| type| source ---|---|--- 2026-02-25 21:19:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfpmcbqaps2d 2026-02-28 11:01:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfw35fsya725...
CVE-2025-68277 OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure Messaging, clicking the link opens the website within the OpenEMR/Portal site. This behavior could be exploited for phishing. Version 7.0...