LaRecipe < 2.8.1 Remote Code Execution via SSTI

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. id: CVE-2025-53833 info:...

Processwire CMS <2.7.1 - Local File Inclusion

Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. id: CVE-2020-27467 info: name: Processwire CMS 2.7.1 - Local File Inclusion author: 0xAkoko severity: high description:...

LionWiki <3.2.12 - Local File Inclusion

LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted strings in the index.php f1 variable, aka local file inclusion. id: CVE-2020-27191 info: name: LionWiki 3.2.12 - Local File Inclusion author: 0xAkoko severity: high description: LionWiki before...

sshuttle

sshuttle: where transparent proxy meets VPN meets ssh As far as I know, sshuttle is the only program that solves the following common case: Your client machine or router is Linux, FreeBSD, MacOS, or Windows experimental. You have access to a remote network via ssh. You don't necessarily have admi...

crowdsec

CrowdSec is an open-source and participative security solution offering crowdsourced server detection and protection against malicious IPs. Detect and block with our Security Engine, contribute to the network, and enjoy our real-time community blocklist. Features & Advantages Versatile Security...

sleuthkit

The Sleuth Kit INTRODUCTION The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems. The Sleuth Kit is open...

Security Bulletin: IBM Cognos Analytics is affected by security vulnerabilities across multiple versions of the product

Summary There are vulnerabilities in multiple Open Source Software OSS components consumed by IBM Cognos Analytics in all supported application versions. This Security Bulletin addresses the affected versions and the remediation versions which contain the fixes. Please note that certain CVEs are...

security-advisories

security-advisories Public security advisories published by Me Chidubem ChukwuTerminal Venom, including CVE disclosures and vulnerability reports for open-source and third-party softwares...

OpenPLC_v3

OpenPLC Runtime version 3 ⚠️ This project has reached End of Life and is no longer maintained. It has been replaced by OpenPLC Runtime v4. Please visit the new repository for installation instructions, documentation, and support. OpenPLC is an open-source Programmable Logic Controller that is base...

Understanding Post-Quantum Cryptography Adoption: Practices, Challenges, and Evolution in Open-Source Software

Post-quantum cryptography PQC standards establish algorithms for quantum-safe systems, but empirical evidence about how software projects implement and maintain PQC support remains limited. We investigate this implementation and maintenance work by mining 114,361 commits and 5,713 issues across 1...

Orphan Open Source Software Object-Graph Navigation Language processing logic error vulnerability

Versions of Orphan Open Source Software Object-Graph Navigation Language prior to 3.4.13 contain a processing logic error vulnerability. This vulnerability arises because the strict invocation mode of OgnlRuntime.invokeMethod only checks the method declaration class; it fails to block...

oss-fuzz

OSS-Fuzz: Fuzzing Continuo per Software Open Source Il fuzz testing è una tecnica ben nota per scoprire errori di programmazione nel software. Molti di questi errori rilevabili, come il buffer overflow, possono avere serie implicazioni per la sicurezza. Google ha trovato migliaia di vulnerabilità...

tinfoleak

tinfoleak La herramienta de código abierto más completa para el análisis de inteligencia en Twitter Introducción tinfoleak es una herramienta de código abierto dentro de las disciplinas OSINT Inteligencia de Fuentes Abiertas y SOCMINT Inteligencia de Redes Sociales, que automatiza la extracción d...

Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports

Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software. The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward...

Characterizing Security Effects of OSS Vulnerabilities in Agent Systems

Software agents increasingly depend on open-source components when executing tools and interacting with external systems. Security flaws in these dependencies may therefore influence more than the software process in which they occur: their consequences can be carried through tool outputs, agent...

CVE-2026-16466 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection...

KLA91278 PE vulnerability in Microsoft Azure

Privilege escalation vulnerability was found in Microsoft Products Open Source Software. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-57104 Exploitation Related products Microsoft-Azure CVE list CVE-2026-57104 critical Solution Install necessary...

CVE-2026-80380

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by cross-site request forgery (CSRF) , allowing a remote attacker with no privileges but requiring user interaction to perform unauthorized actions. The flaw is attributed to open source software components within the product, as indicated b...

CVE-2026-80434 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...

CVE-2026-82100 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...