8074 matches found
DEBIAN-CVE-2026-32772
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEWENVIRON SEND USERVAR...
UBUNTU-CVE-2026-32772
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEWENVIRON SEND USERVAR...
PT-2026-25746
A new vulnerability with increased severity was disclosed for Tenda AC8 CVE-2026-4254 https://t.co/qH9Y5hHYW2...
Malicious code in transform-new-target (npm)
The package 'transform-new-target' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
GNU Inetutils 安全漏洞
GNU Inetutils is a set of common network programs from the GNU community in the United States. Versions of GNU Inetutils 2.7 and earlier contained security vulnerabilities, which stemmed from the telnet protocol allowing servers to read arbitrary environment variables from clients through...
MAL-2026-1572 Malicious code in transform-new-target (npm)
The package 'transform-new-target' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
How to Manually Update GPG key on Veeam Hardened Repository Appliance
Article Applicability This article is specifically regarding the Veeam Hardened Repository ISO v2 appliance, which was distributed alongside Veeam Backup & Replication 12. For information about manually updating the GPG key on the appliances associated with Veeam Backup & Replication 13, review...
PT-2026-25533
A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConfig/management/nmc sync.php of the component HTTP Request Handler. Executing a manipulation of the argument template path can lead to os command injection. Th...
CVE-2026-32772
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEWENVIRON SEND USERVAR...
CVE-2026-32772
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEWENVIRON SEND USERVAR...
CVE-2026-30943
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An insufficient authorization check in the file replace API allows a user with only list visibility permission UserPermListOtherUploads to delete another user's file by abusing the...
Locutus vulnerable to RCE via unsanitized input in create_function()
Summary The createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 GHSA-fp25-p6mj-qqg6 which was calluserfuncarray using eval in v2.x. This finding affects...
GHSA-VH9H-29PQ-R5M8 Locutus vulnerable to RCE via unsanitized input in create_function()
Summary The createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 GHSA-fp25-p6mj-qqg6 which was calluserfuncarray using eval in v2.x. This finding affects...
EUVD-2026-11718
Locutus vulnerable to RCE via unsanitized input in createfunction...
PT-2026-25356
Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.4 Description Gokapi is a self-hosted file sharing server. An authorization flaw in the file replace API allows a user with list visibility permission UserPermListOtherUploads to delete another user's file by...
CVE-2026-32320
Ella Core (5G private-net core) is affected by a DoS when processing a PathSwitchRequest that contains UE Security Capabilities with zero-length NR encryption or integrity protection bitstrings. The issue can crash the process via crafted NGAP messages, leading to service disruption for all conne...
CVE-2026-32304 Locutus: RCE via unsanitized input in create_function()
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from...
CVE-2026-32304
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from...
CVE-2026-32304 Locutus: RCE via unsanitized input in create_function()
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from...