The vulnerability of Linux Astra Modules’ kernel modules, related to insufficient input data validation, allows attackers to trigger service failures.

The vulnerability of Linux Astra Modules’ kernel modules is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

Malicious code in paypal-payouts-bridge (npm)

Malicious npm package published by the microsop threat actor as part of a dependency-confusion campaign that impersonates internal tooling at Microsoft, Google Cloud, and PayPal using inflated semver values e.g. 99.9.x, 100.1.x to win npm resolution against private internal packages. All packages...

CVE-2026-38751

OpenSTAManager version 2.10 and earlier is vulnerable to an authenticated arbitrary file upload within the module update functionality (specifically at modules/aggiornamenti/upload_modules.php). The root cause is a lack of proper validation of file contents or execution boundaries when uploading ...

CVE-2026-38751: Unrestricted Upload of File with Dangerous Type

OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality modules/aggiornamenti/uploadmodules.php...

vm2 代码注入漏洞

vm2 is a high-level virtual machine/sandbox developed by Czech developer Patrik Simek. It runs untrusted code using Node’s built-in modules listed in the allowlist. Versions of vm2 prior to 3.11.0 had a code injection vulnerability; this vulnerability stemmed from the SuppressedError feature, whi...

PT-2026-36895

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions prior to 2.11 Description An arbitrary file upload issue exists in the module update functionality within the 'modules/aggiornamenti/upload modules.php' endpoint. Recommendations Update to a version later than 2.10...

pentest-automation-framework

pentest-automation-framework Built this to speed up structure...

Xseta-WP-Exploit

Xseta-WP-Exploit Xseta - WordPr...

Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft

A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence. The activity has been attributed to the GitHub account "BufferZoneCorp ," which h...

PT-2026-38389

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0 Description NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in the host context. This occurs because...

CVE-2026-3140: Cross-Site Request Forgery (CSRF)

The Ultimate Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.14. This is due to a flawed nonce validation conditional in the 'handlemoduleactions' function. This makes it possible for unauthenticated attackers to toggle plugin...

CVE-2026-42484

A heap-based buffer overflow in hextobinary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When datatypeenum=1,...

PT-2026-36352

Name of the Vulnerable Software and Affected Versions hashcat version 7.1.2 Description A heap-based buffer overflow exists in the Kerberos hash parser. The issue occurs within the module hash decode function across several Kerberos-related modules. It is caused by the account info len variable...

CVE-2026-42484

A heap-based buffer overflow in hextobinary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When datatypeenum=1,...

CVE-2026-42800

NULL pointer dereference vulnerability in ASR1903 in ASR LapwingLinux on Linux imsclient modules allows Pointer Manipulation. This vulnerability is associated with program files sip/utils/src/sipuri.c...

EUVD-2026-26360

NULL pointer dereference vulnerability in ASR1903 in ASR LapwingLinux on Linux imsclient modules allows Pointer Manipulation. This vulnerability is associated with program files sip/utils/src/sipuri.c...

EUVD-2026-26358

Out-of-bounds read vulnerability in ASR Kestrel nrfw modules allows Overflow Buffers. This vulnerability is associated with program files Code/Nr/nrfw/RA/src/NrPwrCtrl.C. This issue affects Kestrel: before 2026/02/10...

PT-2026-36083

Name of the Vulnerable Software and Affected Versions ASR Kestrel versions prior to 2026/02/10 Description An out-of-bounds read issue in the nr fw modules allows overflow buffers. This flaw is associated with the program file Code/Nr/nr fw/RA/src/NrPwrCtrl.C. Recommendations Update ASR Kestrel t...

CVE-2026-42799: Out-of-bounds Read

Out-of-bounds read vulnerability in ASR Kestrel nrfw modules allows Overflow Buffers. This vulnerability is associated with program files Code/Nr/nrfw/RA/src/NrPwrCtrl.C. This issue affects Kestrel: before 2026/02/10...

Debian dsa-6238 : ata-modules-6.12.74+deb13+1-armmp-di - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6238 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6238-1 [email protected] https://www.debian.org/securit...