Flare 安全漏洞

Flare is a file-sharing platform developed by Zachary Lowery. Versions of Flare prior to 1.7.2 contained security vulnerabilities. These vulnerabilities stemmed from the lack of verification of the password for password-protected files at the thumbnail endpoint, allowing unauthorized access to...

Linux kernel binder_alloc_set_vma binder_alloc_init Buffer Overflow DoS

The vulnerabilities of the binderallocsetvma and binderallocinit functions in the drivers/android/binderalloc.c file of the Linux kernel’s communication driver with Android cores are related to improper initialization. Exploiting these vulnerabilities can allow a remote attacker to compromise the...

PowerPC early_init_devtree() Buffer Overflow

The vulnerability of the earlyinitdevtree function in the arch/powerpc/kernel/prom.c file, which is part of the PowerPC platform support for the Linux operating system, is related to code errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

Oracle Database Server Listener Unauthorized Access

The vulnerability of the RDBMS Listener component of the Oracle Database Server management system is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PyPDF Uncontrolled Resource Consumption

The vulnerability of the Python library for working with PDF files, PyPDF, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to compromise the accessibility of protected information...

Linux kernel alloc_quote_buf Heap Buffer Overflow Info Disclosure

The vulnerability of the allocquotebuf function in the drivers/virt/coco/tdx-guest/tdx-guest.c file of the Linux kernel is related to errors in handling exceptional conditions. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected information...

Oracle Database Server XML Unauthorized Access

The vulnerability of the XML component of the Oracle Database Server system is related to access control errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Moodle Insufficient Validation Unauthorized Access

The vulnerability in the virtual learning environment Moodle is related to insufficient testing of server-side requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

VMware Workstation Heap Buffer Overflow DoS

The vulnerability of VMware Workstation’s hypervisor is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

A suspected Iran-nexus threat actor has been attributed to a campaign targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs to deliver a set of never-before-seen malware. Zscaler ThreatLabz, which observed the activity in January 2026, is tracking the...

PT-2026-23619

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.2.2 Description An issue exists in Plane that allows unauthenticated attackers to enumerate workspace members and extract sensitive information, including email addresses, user roles, and internal identifiers. This is...

Rockwell Multiple Products Insufficient Protected Credentials Vulnerability

Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this...

CVE-2026-29045

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections e.g. app.use'/admin/', ..., inconsistent URL decoding allowed protected static resources to be accessed without...

CVE-2026-29045

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections e.g. app.use'/admin/', ..., inconsistent URL decoding allowed protected static resources to be accessed without...

CVE-2026-29045 Hono: Arbitrary file access via serveStatic vulnerability

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, when using serveStatic together with route-based middleware protections e.g. app.use'/admin/', ..., inconsistent URL decoding allowed protected static resources to be accessed without...

CVE-2026-27801 Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass ...

CVE-2026-27801

Vaultwarden (unofficial Bitwarden server) is affected by CVE-2026-27801 where versions 1.34.3 and earlier permit a 2FA bypass on protected actions due to faulty rate-limit enforcement. An authenticated attacker can perform protected actions (e.g., access a user’s API key or delete vaults and orga...

CVE-2026-27801 Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass ...

CVE-2026-27801 Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass ...

Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

Summary Vaultwarden v1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a users account can exploit this bypass to perform protected actions such as accessing the user's API key or deleting the user's vault and...