Apache Tomcat Servers - Remote Code Execution

Apache Tomcat servers 7.0.0 to 79 are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to t...

Oracle Weblogic Server - Remote Command Execution

Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. id: CVE-2020-14882 info: name: Oracle Weblogic Server - Remote Command Execution author: dwisiswant0 severity:...

Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion

Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software is vulnerable to local file inclusion due to directory traversal attacks that can read sensitive files on a targeted system because of a lack of proper input validation of URLs in HTTP requests processe...

MHDDoS v2.4.5

MHDDoS - DDoS Attack Script With 57 Methods Programming Language - Python 3 Please Don't Attack websites without the owner's consent. Features And Methods 💣 Layer7 GET | GET Flood POST | POST Flood OVH | Bypass OVH !ov...

systeminformer v4.0.26241.138

System Informer A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc...

MAL-2026-15553 Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...

Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001432)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001432 advisory. In the Linux kernel, the following vulnerability has been resolved: ila: call nfunregisternethooks sooner syzbot found an use-after-free Read in ilanfinput 1 Issue...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001464)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001464 advisory. In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error If e.g. the ataportalloc call in atahostalloc fails, w...

Security update for broot (moderate)

openSUSE security update: security update for broot ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21675-1 Rating: moderate References: bsc1275994 Cross-References: CVE-2026-72847 CVSS scores: CVE-2026-72847 SUSE : 4.6...

Linux Distros Unpatched Vulnerability : CVE-2026-37236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP- Method-Override header in ServeMux.ServeHTTP without...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001448)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001448 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in sidpminit When the allocation of...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-104993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104993 advisory. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII- only label. For example, ToUnicodexn--example-.com incorrectl...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001433)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001433 advisory. In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of STR method Only buffer objects are valid return values of ST...

GHSA-J5G3-42WP-GQM3 Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

GHSA-334Q-H5G3-FPXV free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

OPENSUSE-SU-2026:21675-1 Security update for broot

This update for broot fixes the following issues: Changes in broot: - v1.59.0 CVE-2026-72847 boo1275994 new shellcommand verb attribute: run a command through a shell sh -c / cmd /C so &&, ; and pipes work, without leaving broot - Fix 1145 fix invalid official Mac binary duplicate linked dylib wi...

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

Summary Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled=true but cluster.sharedsecret is not configured. The coordinator validates HMAC authentication only if a shared secret is non-empty; otherwise, a network attacker who can reach the...