Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler

Impact All versions of mckenziearts/livewire-markdown-editor prior to v1.3 contain a critical arbitrary file upload vulnerability in the MarkdownEditor::updatedAttachments Livewire handler. The handler calls $file-store with no server-side validation of MIME type, extension, or file content. Any...

GHSA-3H23-7824-PJ8R ArchiveBox Vulnerable to RCE via unvalidated per-crawl config overrides in AddView

The /add/ endpoint AddView in core/views.py accepts a config JSON field that gets merged into the crawl config without validation. This config is exported as environment variables when archive plugins run, allowing injection of arbitrary tool arguments to achieve RCE. When PUBLICADDVIEW=True comm...

CVE-2026-42079

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable to arbitrary code execution via Python eval of LLM-generated code with builtins in scope. This issue has been patched via commit 418491a...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab...

CVE-2026-43862

In mutt before 2.3.2, the imapauthgss security level is mishandled...

CVE-2026-43861

mutt before 2.3.2 does not check for '\0' in urlpctdecode...

GoBGP 数字错误漏洞

GoBGP is an open-source implementation of the Border Gateway Protocol BGP developed by osrg. Versions of GoBGP prior to 4.3.0 contained a numerical error vulnerability. This vulnerability stemmed from an integer underflow in the function parseRibEntry within the file pkg/packet/mrt/mrt.go, allowi...

PT-2026-36925

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A security flaw in the authentication-subscription component allows remote exploitation leading to a denial of service. The issue exists within the udm nudr dr handle subscription authentication...

PT-2026-36743

Name of the Vulnerable Software and Affected Versions ravenwits mcp-server-arangodb versions prior to 0.4.8 Description A path traversal issue exists in the MCP Interface component within the arango backup function of the src/tools.ts file. A remote attacker can manipulate the outputDir argument ...

Pluck CMS 跨站脚本漏洞

Pluck CMS is an open-source content management system developed by Plunk CMS. Versions of Pluck CMS prior to 4.7.21dev contained a cross-site scripting vulnerability. This vulnerability stemmed from the editpage.php and sanitizePageContent functions, which allowed remote attackers to gain elevate...

Calibre-Web Automated 安全漏洞

Calibre-Web Automated is a self-hosted digital library management tool developed by CrocodileStick’s individual developer. Versions of Calibre-Web Automated prior to 4.0.6 contained security vulnerabilities. These vulnerabilities stemmed from improper authorization in the generateauthtoken functi...

ALSA-2026:13498 Important: dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

PT-2026-36673

Name of the Vulnerable Software and Affected Versions Shenzhen Libituo Technology LBT-T300-HW1 versions prior to 1.2.8 Description A buffer overflow exists in the Web Management Interface component. A remote attacker can trigger this issue by manipulating the vpn pptp server or vpn l2tp server...

Shenzhen Libituo Technology LBT-T300-HW1 缓冲区错误漏洞

Shenzhen Libituo Technology LBT-T300-HW1 is an industrial router produced by Shenzhen Libituo Technology. Versions of Shenzhen Libituo Technology LBT-T300-HW1 prior to 1.2.8 contain a buffer error vulnerability. This vulnerability stems from the function startlan in the file/apply.cgi file, which...

EDIMAX BR-6208AC 缓冲区错误漏洞

The EDIMAX BR-6208AC is a wireless broadband router produced by Edimax Corporation of Taiwan. Versions of the Edimax BR-6208AC prior to 1.02 contained a buffer overflow vulnerability. This vulnerability stemmed from an unknown function in the file/goform/setWAN, which handled the parameter...

Edimax BR-6428nC 注入漏洞

The Edimax BR-6428nC is a multi-functional wireless broadband router produced by Edimax Corporation. Versions of Edimax BR-6428nC prior to 1.16 contained a vulnerability. This vulnerability stemmed from an unknown function in the component’s Web Interface, specifically the file/goform/setWAN, whi...

gnutls: gnutls: Authentication Bypass via NUL Character in Username

A flaw was found in gnutls. Servers configured with RSA-PSK Rivest–Shamir–Adleman – Pre-Shared Key wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass...

SUSE CVE-2026-31711

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix activenumconn leak on transport allocation failure Commit 77ffbcac4e56 "smb: server: fix leak of activenumconn in ksmbdtcpnewconnection" addressed the kthreadrun failure path. The earlier alloctransport == NULL...