GHSA-X768-8642-MMQ9 MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

GHSA-Q4GH-4FFP-5CG8 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

Summary When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands SECRETNAME placeholders in every inbound socket payload before passing it to module helpers. Any client that can...

MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

Summary When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands SECRETNAME placeholders in every inbound socket payload before passing it to module helpers. Any client that can...

GHSA-C9FV-CGMM-2WG7 LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...

LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module

Summary A vulnerability has been identified that allows an authenticated administrator to execute arbitrary code on the host server. By adding an alert transport entry, an attacker with administrative privileges can execute malicious commands. Details The vulnerability is caused by an unsafe exec...

CVE-2026-72252

A flaw was found in the Linux kernel. A memory allocation failure during network filter operations can lead to an inconsistent state within the netfilter: nftsetpipapo module. This inconsistency can result in out-of-bounds writes, which may allow a local attacker to cause a system crash denial of...

CVE-2026-72250

A flaw was found in the Linux kernel's nfconntrackreasm module, specifically within the IPv6 defragmentation process. An attacker could exploit this by sending specially crafted IPv6 fragmented packets. The nfctfrag6reasm function incorrectly adjusts the macheader offset, causing the system to...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the manager.go file. An attacker can write files to arbitrary user-writable locations by convincing a user to install or execute a malicious plugin. Note: This is only exploitable if the plugin is not sourced fro...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the manager.go file. An attacker can write files to arbitrary user-writable locations by convincing a user to install or execute a malicious plugin. Note: This is only exploitable if the plugin is not sourced fro...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the manager.go file. An attacker can write files to arbitrary user-writable locations by convincing a user to install or execute a malicious plugin. Note: This is only exploitable if the plugin is not sourced fro...

EUVD-2026-61079

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640

In MagicMirror² versions before 2.37.0, the catch-all socket dispatcher in js/node_helper.js runs replaceSecretPlaceholder on every inbound payload, letting an attacker submit a SECRET_API_KEY placeholder that expands to the live env value; the weather helper then echoes it back via WEATHER_ERROR...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-72243

A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network...

CVE-2026-72241

A flaw was found in the kernel. In the leds: uleds module, a buffer overread can occur because the name string provided by userspace is not guaranteed to be null-terminated. This can lead to a local attacker potentially reading sensitive information from adjacent memory or causing a denial of...

CVE-2026-72234

A flaw was found in the Linux kernel's batman-adv module. When the pskbmaypull function is called by batadvgetvid, it can reallocate a buffer. However, a pointer to the old buffer, specifically unicastpacket, was not correctly reassigned, leading to a use-after-free condition. This memory...

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

GHSA-W26R-FWG8-RCP3 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...