43792 matches found
SUSE-SU-2026:23742-1 Security update for kbd
This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441...
Malicious code in process-mite (npm)
This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...
MAL-2026-16224 Malicious code in process-mite (npm)
This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...
SUSE-SU-2026:4207-1 Security update for kbd
This update for kbd fixes the following issue: - CVE-2026-72693: local privilege escalation in openvt due to incorrect process owner verification that allows passwordless root login bsc1275441...
Malicious code in swnwall (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a On require/import, index.js invokes initialize which spawns loader.js as a detached, hidden background child process detached: true, windowsHide: tru...
CVE-2026-76559
The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the failure to properly validate URLs during the import process , allowing users with the import capability (such as administrators) to force the sit...
EUVD-2026-80183
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...
Exploit for Heap-based Buffer Overflow in Microsoft
!Rulehttps://img.shields.io/badge/RULE-SOC335-00FF41?style=fo...
TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38418)
TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the getSlaveUpdate function. Attackers can exploit this vulnerability by sending specially crafted POST...
CVE-2026-20135: Double Free
A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. This vulnerability is due to improper buffer...
CVE-2026-82561: Missing Authorization
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...
PT-2026-93931
Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.11.0 Description Certain REST API methods used for replacing Process Group contents, versioned flow updates, and rebase operations lack sufficient authorization checks. While asynchronous update methods...
TencentOS Server 4: libpcap (TSSA-2026:1013)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1013 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CVE-2026-91843 - Stack overflow in login process to the Security Management and Log Servers
Symptoms - Issue: A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. This issue received the ID CVE-2026-91843 and a CVSS score of 9.8. Affected Products: Security Management Server, Multi-Domain Security Management...
PT-2026-94068
Name of the Vulnerable Software and Affected Versions Uber Kraken versions 0.1.0 through 0.1.29 Description An issue exists where the application fails to validate the tag parameter in the '/tags/tag' endpoint. This allows unauthenticated attackers to perform directory traversal by using...
CVE-2026-86089: Missing Authorization
Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...
PT-2026-93932
Name of the Vulnerable Software and Affected Versions Apache NiFi version 2.11.0 Description An authorization flaw exists in the REST API methods used to list migration sources and submit migration requests when moving version-controlled Process Group contents into a Connector. The system only...
PT-2026-93419
Name of the Vulnerable Software and Affected Versions DuoxMe application versions prior to 4.3.4 VEO and VEO-XS Wi-Fi monitor firmware versions prior to 01.50.001 Description Home Wi-Fi credentials are transmitted without encryption during the pairing process between the DuoxMe application and VE...
PT-2026-93954
Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description An issue in the TLS 1.3 implementation allows an unauthenticated remote attacker to cause a device to reload unexpectedly, leading to a denial of...
CVE-2026-81875: Improper Input Validation
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header...