sharingIsCaring

sharingIsCaring TwonkyMedia Server Pwnd CVE-2018-7171 Background information This is a GitHub repository keeping all relevant information about CVE-2018-7171. and more CVE-2018-7171 represents a directory/file traversal vulnerability in TwonkyMedia Server version 7.0.11-8.5 latest version...

CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: ffmpegツールオプションを介したOSコマンドインジェクション runFFmpegCommand は、MCPツールのパラメータから構築した文字列を spawn…, shell: true に渡すため、options、format、codec、pixelFormat、extraOptions に含まれるシェルのメタ文字が、サーバーを実行しているホスト上で実行されます。 ⚠ 修正版は存在しません 2026-08-22現在、最新のnpmリリースは 0.2.1 であり、これが影響を受ける...

CSV Injection

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell...

CVE-2026-63654

Frappe (full-stack web application framework) versions 16.31.0 and earlier contain a vulnerability in the frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py. The whitelisted endpoint is not restricted to POST , meaning it accepts safe HTTP methods (e.g., GET) for st...

CVE-2026-55586

SumatraPDF 3.6.1 and earlier (Windows) contains a heap out-of-bounds write in the vendored CHMLib LZX decompressor. A crafted CHM file can supply malformed Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, internal nodes are written via next_symbol before val...

EUVD-2026-63480

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-68900

creationtimestamp| type| source ---|---|--- 2026-08-19 21:01:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthmtw75wv2t...

MINI-8XH7-CQ46-FFRJ

Bulletin has no description...

MINI-2X84-H83P-C75C

Bulletin has no description...

MINI-J3JQ-W7RX-5XFR

Bulletin has no description...

MINI-HWC4-M8C9-HHF8

Bulletin has no description...

CVE-2026-73849

In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...

Linux Distros Unpatched Vulnerability : CVE-2026-56859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56859 Note that Nessus relies on...

PT-2026-72074

Name of the Vulnerable Software and Affected Versions Emlog versions prior to 2.6.27 Description The install.php endpoint allows the action parameter to be set to reinstall without authentication. This bypasses the installation check because the security guard only executes when the $act variable...

PT-2026-70437

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70050

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently sanitize certain request headers before forwarding traffic to internal components. This allows an unauthenticated attacker to send a specially crafte...

PT-2026-70388

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description An issue exists where the allocation of resources occurs without limits or throttling, which allows an unauthorized attacker to cause a denial-of-service condition over a network...

PT-2026-70411

Name of the Vulnerable Software and Affected Versions Windows TCP/IP affected versions not specified Description A null pointer dereference in Windows TCP/IP allows an unauthorized attacker to cause a denial of service over a network. A null pointer dereference occurs when a program attempts to...

PT-2026-70579

Name of the Vulnerable Software and Affected Versions Windows DNS affected versions not specified Description A numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations At the moment, there is no...