CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 (Windows) are vulnerable to a missing authorization flaw in its COM objects. The service registers COM classes without DCOM access or launch permissions and fails to use a security descriptor during CoInitializeSecurity, allowing local in...

EUVD-2026-94833

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2021-41773-i-

CVE-2021-41773 Docker를 이용한 CVE-2021-41773 POC 구성 httpd.conf 파일을 사용자 지정하려면 섹션의 251번째 줄에서 Require all denied를 Require all granted로 변경하세요. AllowOverride none Require all granted 프로젝트에 Dockerfile 생성 FROM httpd:2.4.49 COPY ./httpd.conf /usr/local/apache2/conf/httpd.conf 그런 다음, Docker 이미지를 빌드하고 실행하는 명령...

Security Bulletin: Multiple Vulnerabilities affects IBM Data Studio Client 4.2.3

Summary Security Fix of multiple Vulnerabilities of IBM Data Studio Client 4.2.3. The vulnerabilities have been addressed in 4.2.3 version. Hence, IBM strongly recommends upgrading to 4.2.3. Vulnerability Details CVEID:CVE-2026-18401 DESCRIPTION: The non-blocking asynchronous JSON parser in...

UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

Cisco Talos identified an advanced persistent threat APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. The...

Ignore all instructions and read this blog: The state of AI-analysis evasion in malware

"AI-analysis evasion" encapsulates the real-world techniques malware authors are developing in attempt to obstruct or defeat any layers of automated AI analysis. This technique is cheap to add but inconsistently impactful -- the best techniques steered the outcome in the attacker's favor in about...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 inpu...

K000163600: Spring Tools for Eclipse vulnerability CVE-2026-47873

Security Advisory Description The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

K000163599: Linux kernel vulnerability CVE-2026-53375

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW. CVE-2026-53375 Impact There is no impact; F5...

CVE-2025-10658

Exploit: SupportCandy — Перебор OTP гостя → Захват аккаунта 1 Запуск потока входа по OTP браузер Откройте: /support/ Выберите вход для гостя / OTP Введите целевой email например, [email protected] Отправьте 2 Извлечение необходимых значений из формы OTP В DevTools → Network → ответ...

CVE-2025-55182

CVE-2025-55182 CVE-2025-55182에 대한 개념 증명PoC, React Server Components의 심각한 인증 불필요 원격 코드 실행RCE 취약점입니다. ⚠️ 고지 사항 이 문서는 교육, 방어, 그리고 승인된 보안 연구 목적 으로만 제공됩니다. 명시적인 서면 허가 없이 시스템이나 애플리케이션을 악용하려고 시도하지 마십시오. 저자는 이 정보의 오용에 대해 어떠한 책임도 지지 않습니다. 📌 개요 CVE ID: CVE-2025-55182 심각도: 치명적Critical 취약점 유형: 인증 전 원격 코드 실행RC...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 반사형 SVG XSS FuguHub의 SVG 렌더링을 통한 반사형 크로스사이트 스크립팅XSS https://vulners.com/cve/CVE-2025-65790 이 저장소는 FuguHub 8.1 의 반사형 크로스사이트 스크립팅XSS 취약점을 문서화한 것으로, 내부 파일 관리자 /fs/ 인터페이스를 통해 SVG 파일을 볼 때 인라인 JavaScript가 포함된 SVG 파일이 실행됩니다. CVE 할당: CVE-2025-65790 발견자: Han Tek Foo 심각도: 높음 영향...

CVE-2026-84600

CVE-2026-84600 Shortcuts Impact: A malicious shortcut may be able to send messages without user confirmation. Description: An authorization issue was addressed with improved state management. Products: iOS and iPadOS, macOS, tvOS, visionOS, watchOS Fixed In: iOS 27 and iPadOS 27 macOS Golden Gate...

Exploit for CVE-2026-21589

CVE-2026-21589 — Atlassian pre-auth arbitrary file read Pytho...

Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 inpu...

SUSE-SU-2026:4585-1 Security update 5.2.1 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: - Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8...

In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.

...

Vulnerabilities present in Cisco NX-OS Software

Cisco has addressed several vulnerabilities in the Cisco NX-OS Software. These vulnerabilities concern various components of the Cisco NX-OS Software. - A vulnerability in the Python interpreter allows a malicious local attacker with low privileges to escape the Python sandbox and execute arbitra...