CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

Server-side Request Forgery (SSRF)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the urlopen process in nltk.pathsec. An attacker can reach loopback or internal HTTP services by...

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Summary nltk.pathsec provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges including obfuscated forms and recommending strict ENFORCE mode for security-sensitive environments. The filter is bypassable by DNS rebinding:...

Exploit for CVE-2026-64531

OVSwrap CVE-2026-64531 Mitigation Tool A simple script that...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules undici, js-yaml, fast-uri, protobufjs and @opentelemetry/core...

Chromium: CVE-2026-17973 Inappropriate implementation in Views

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-17700 Insufficient validation of untrusted input in Actor

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Exploit for Improper Authorization in Microsoft

Metasploit-CVE-2026-54121-Certighost Certighost originally dis...

pwndbg v2026.07.29

pwndbg pwndbg /paʊnˈdiˌbʌɡ/ is a GDB and LLDB plug-in that makes debugging suck less, with a focus on features needed by low-level software developers, hardware hackers, reverse-engineers and exploit developers. It has a boatload of features, see our Features page and CHEATSHEET feel free to prin...

PT-2026-105526

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import module class helper within sentence transformers/util/misc.py, where the guard condition includes an 'or os.path.existsmodel na...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

EUVD-2026-51644

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

PT-2026-66857

Name of the Vulnerable Software and Affected Versions totadministrativemandate versions prior to 1.8.1 Description The payment validation controller in the PrestaShop module lacks a CSRF token, making it susceptible to Cross Site Request Forgery CSRF. This allows an attacker to confirm an order...

Python pip Directory Restriction

The vulnerability of the Python programming language’s pip module is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

Linux kernel-based firmware th1520_aon_power_update() Data Compromise

The vulnerability of the th1520aonpowerupdate function in the drivers/firmware/thead module, within the th1520-aon.c driver for Linux kernel patches, is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability...

Bouncy Castle FrodoEngine Java Disclosure

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library relates to the use of hidden time channels for data transmission. Exploiting this vulnerability allows a remote attacker to disclose the protected information...

Bouncy Castle BCPKIX Bypass

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library is related to the use of the outdated SHA-1 cryptographic algorithm. Exploiting this vulnerability allows a remote attacker to bypass existing security measures...

CVE-2026-50986

The PrestaShop module totadministrativemandate versions prior to 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF) . The vulnerability exists because the payment validation controller lacks a CSRF token , which allows an attacker to confirm an order in an awaiting status by hijacking a lin...

CVE-2026-9044: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

Malicious Package

Overview host-inspector-module is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...