Vitest Browser Mode - Local File Read

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...

MINI-8QR5-HC5Q-GRC2

Bulletin has no description...

Roxy-WI - Remote Code Execution

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands. id: CVE-2022-31161 info: name: Roxy-WI - Remote Code...

Discourse Backup File Disclosure Via Default Nginx Configuration

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore--LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

MINI-R5H8-4WQW-3C6F

Bulletin has no description...

CVE-2026-47661

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

Security Bulletin: IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428

Summary IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-54428 DESCRIPTION: Allocation of resources without limits or throttling in t...

MAL-2026-11889 Malicious code in @servicetitan/log-service (npm)

npm/@servicetitan/log-service is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-20482

In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote proximal/adjacent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00486814; Issue ID: MSV-6824...

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript string literal inside the HttpClient constructor body of the generated axios client templates/base/http-clients/axios-http-client.ejs:71, without any escaping. A malicious URL containing a " closes the string...

CVE-2026-58183 Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the iss...

CVE-2026-33930 Apache Traffic Server: Buffer overflow via Host field that has a long string value

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through...

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

Linux Distros Unpatched Vulnerability : CVE-2026-24033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server:...

CVE-2026-66921 Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More

Monday starts with the usual promise that everything is under control. Then the logs wake up. This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped...

PT-2026-65091

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Ticket...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the encodeHeaders in the STOMP frame encoder, which fails to validate or escape newline characters in header values for certain commands. An attacker can inject arbitrary headers by including newline characters in...

DRUPAL-CONTRIB-2026-089

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-085

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...