RHSA-2026:39319 Red Hat Security Advisory: git-lfs security update

Bulletin has no description...

RHSA-2026:39272 Red Hat Security Advisory: git-lfs security update

Bulletin has no description...

RHSA-2026:39266 Red Hat Security Advisory: git-lfs security update

Bulletin has no description...

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below - @asyncapi/[email protected]...

Exploit for Path Traversal in Mindsdb

CVE-2026-27483 Lab - Enterprise Vulnerability Learning Environ...

Exploit for CVE-2026-15410

cve-id ⚡ Simple Usage Use this project only in safe and...

Exploit for CVE-2026-15409

cve-id ⚡ Simple Usage Use this project only in safe and...

vulnlab

vulnlab 🔓 !CI Statushttps://github.com/37Linard/vulnlab/a...

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

MAL-2026-10627 Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

PT-2026-60386

Summary Koel's outbound-URL guard AppHelpersNetwork::isPublicHost classifies an IP as "public" using PHP's filter var$ip, FILTER VALIDATE IP, FILTER FLAG NO PRIV RANGE | FILTER FLAG NO RES RANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-loc...

PT-2026-60384

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

PT-2026-60390

Summary @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default :3080 / 0.0.0.0:3080 instead of localhost-only, and its document-management API endpoints do not require...

Security update for tomcat11 (moderate)

openSUSE security update: security update for tomcat11 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21329-1 Rating: moderate References: bsc1232390 bsc1269791 bsc1269824 bsc1269907 bsc1269908 bsc1269909 bsc1269910 Cross-References: CVE-2026-50229...

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication through contrib/paramikovendor.py in the SSH connection path. An attacker can intercept or impersonate an SSH server and have the client connect without validating the server’s host key by...

PT-2026-60323

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.35 Description The cloneBoard Meteor method in models/import.js fails to invoke the canExport function or verify membership of the source board when using the sourceBoardId variable. This allows an authenticated user...

PT-2026-60374

Summary ToolHive's hand-rolled private/reserved-IP SSRF guard networking.IsPrivateIP in pkg/networking/utilities.go does not recognize the IPv6 NAT64 address ranges — the well-known prefix 64:ff9b::/96 RFC 6052 and the RFC 8215 local-use prefix 64:ff9b:1::/48. As a result, an address such as...

SUSE SLES12: farstream-data / farstream-devel / finch / finch-devel / etc (SUSE-SU-2026:2967-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:2967-1 advisory. This update for libgnt, meson, pidgin fixes the following issues Security issue: - CVE-2019-25544: denial of service vulnerability that allows local...

PT-2026-60275

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the bulk delete API endpoint and pass attacker-controlled identifiers to ExportCenterManage.delete, allowing recursive deletion of...

PT-2026-60375

Summary Unbounded recursion depth in Protobuf.Decoder Hex package protobuf, versions = 0.8.0, 0.16.1 lets an unauthenticated attacker crash any service that decodes untrusted protobuf messages whose schema contains a self-referential or cyclic message type. A small request body a few KB to a few ...