Exploit for CVE-2022-25476

CVE-2022-25476 ⚡ Simple Usage Use this project only in s...

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...

PT-2026-60697

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell exec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

PT-2026-60674

Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell exec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...

PT-2026-60558

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

PT-2026-60698

Summary Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal feature...

PT-2026-60504

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc parse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer. Truncated strings such as "a/" can trigger an out-of-bounds read. Note that...

PT-2026-60669

Summary Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal feature...

openSUSE 16: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (openSUSE-SU-2026:21328-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21328-1 advisory. This update for tomcat10 fixes the following issues Update to Tomcat 10.1.56. Security issues fixed: - CVE-2026-50229: improper neutralization o...

The vulnerability of the mechanism for displaying discussions about commit messages and project-specific links on the Git-based software platform, which is used for collaborative code development on GitLab CE/EE, allows a perpetrator to breach the confidentiality of protected information.

The vulnerability of the mechanism for displaying commit discussions and project-specific links on the Git-based software platform for collaborative code development on GitLab CE/EE is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious act...

The vulnerability of the mechanism used by Git to resolve programmatic platform URLs for collaborative code development on GitLab CE/EE allows a perpetrator to compromise the integrity of protected information.

The vulnerability of the mechanism for resolving Git-link names in the software platform based on Git for collaborative code development in GitLab CE/EE is related to the use of a name with an incorrect link. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

The vulnerability of the mirroring mechanism of the Git-based software platform for collaborative code development, GitLab EE, allows a violator to compromise the confidentiality of protected information.

The vulnerability of the repository mirroring mechanism of the Git-based software platform for collaborative code development in GitLab CE/EE is related to insufficient protection of registration data. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the...

The vulnerability of the mechanism for checking access rights to metadata of working elements in private projects of a Git-based software platform for collaborative code development on GitLab EE allows a violator to breach the confidentiality of protected information.

The vulnerability of the mechanism for checking access rights to metadata of working elements in private projects of a Git-based software platform for collaborative code development on GitLab CE/EE is related to deficiencies in the authorization process. Exploiting this vulnerability could allow ...

Release Information for Fsas ETERNUS EP300 Plug-In for Veeam Backup & Replication

This plug-in leverages the Veeam Universal Storage API, which enables storage OEMs to allow Veeam Backup & Replication integration to the arrays for backup and replication jobs. Requirements Before installing Fsas ETERNUS EP300 Plug-In v2.2.309, make sure that you are running Veeam Backup &...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Linux Distros Unpatched Vulnerability : CVE-2026-47423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to...

PT-2026-60499

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "" or unbalanced quotes "" can...

openSUSE 16: tomcat11 / tomcat11-admin-webapps / tomcat11-el-6_0-api / etc (openSUSE-SU-2026:21329-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21329-1 advisory. This update for tomcat11 fixes the following issues Update to Tomcat 11.0.23. Security issues fixed: - CVE-2026-50229: improper neutralization o...

RockyLinux 8 : git-lfs (RLSA-2026:39266)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39266 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...

Oracle Linux 8 : git-lfs (ELSA-2026-39266)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39266 advisory. 3.4.1-12 - Rebuild with new Golang - Resolves: RHEL-187191 Tenable has extracted the preceding description block directly from the Oracle Linux security...