Exploit for Missing Authentication for Critical Function in Estrongs Es_File_Explorer_File_Manager

CVE-2019-6447: ES File Explorer Unauthenticated HTTP Service...

RHSA-2026:39319 Red Hat Security Advisory: git-lfs security update

Bulletin has no description...

RHSA-2026:39272 Red Hat Security Advisory: git-lfs security update

Bulletin has no description...

RHSA-2026:39266 Red Hat Security Advisory: git-lfs security update

Bulletin has no description...

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below - @asyncapi/[email protected]...

Exploit for Path Traversal in Mindsdb

CVE-2026-27483 Lab - Enterprise Vulnerability Learning Environ...

Exploit for CVE-2026-15410

cve-id ⚡ Simple Usage Use this project only in safe and...

Exploit for CVE-2026-15409

cve-id ⚡ Simple Usage Use this project only in safe and...

vulnlab

vulnlab 🔓 !CI Statushttps://github.com/37Linard/vulnlab/a...

MAL-2026-10627 Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

glibc security update

2.39-121.0.1 - Forward port Oracle changes to 2.39-121. - Reviewed-by: David Faust Oracle history: April-2-2026 Cupertino Miranda - 2.39-113.0.1 - Reverted to version 2.39-113. - Reviewed-by: David Faust February-3-2026 Cupertino Miranda - 2.39-99.0.1 - Forward port Oracle changes to 2.39-99. -...

PT-2026-60386

Summary Koel's outbound-URL guard AppHelpersNetwork::isPublicHost classifies an IP as "public" using PHP's filter var$ip, FILTER VALIDATE IP, FILTER FLAG NO PRIV RANGE | FILTER FLAG NO RES RANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-loc...

PT-2026-60384

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

PT-2026-60390

Summary @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default :3080 / 0.0.0.0:3080 instead of localhost-only, and its document-management API endpoints do not require...

PT-2026-60323

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.35 Description The cloneBoard Meteor method in models/import.js fails to invoke the canExport function or verify membership of the source board when using the sourceBoardId variable. This allows an authenticated user...

PT-2026-60375

Summary Unbounded recursion depth in Protobuf.Decoder Hex package protobuf, versions = 0.8.0, 0.16.1 lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body a few KB to a few ...

SUSE SLES12: farstream-data / farstream-devel / finch / finch-devel / etc (SUSE-SU-2026:2967-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2967-1 advisory. This update for libgnt, meson, pidgin fixes the following issues Security issue: - CVE-2019-25544: denial of service vulnerability that allows local...

AlmaLinux 9 : git-lfs (ALSA-2026:39319)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39319 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block directl...

PT-2026-60374

Summary ToolHive's hand-rolled private/reserved-IP SSRF guard networking.IsPrivateIP in pkg/networking/utilities.go does not recognize the IPv6 NAT64 address ranges — the well-known prefix 64:ff9b::/96 RFC 6052 and the RFC 8215 local-use prefix 64:ff9b:1::/48. As a result, an address such as...