CVE-2026-67364

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

EUVD-2026-62397

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

CVE-2026-67364

Balbooa Forms for Joomla (versions

CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the...

Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

SummaryThe SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur/certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback, link-loc...

PYSEC-2026-3676 Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...

PYSEC-2026-3675 Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...

Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

SummaryRepo under test: https://github.com/Netflix/lemurThe certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...

vLLM: Completion prompt lists fan out into unbounded engine requests

SummaryThe /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a...

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...

PYSEC-2026-3658 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...

PYSEC-2026-3704 vLLM: Completion prompt lists fan out into unbounded engine requests

Summary The /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a...

secator v0.42.0

The pentester's swiss knife. Features • Supported commands • Installation • Usage • Documentation • Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...

Titanis v0.9.333

Introduction Titanis is a library of protocol implementations and command line utilities, written in C, for interacting with Windows environments. It uses .NET 8 and is cross-platform Windows and Linux. Some of the protocols implemented: SMB2 MS-SMB2 SMB 2.x and 3.x up to 3.1.1 Message security...

CVE-2026-72152

A flaw was found in the Linux kernel's Trusted Platform Module TPM TIS SPI driver. The waiteventinterruptibletimeout function incorrectly evaluates its condition after setting the task state, which can trigger a warning when debugging atomic sleeps and using the Interrupt Request IRQ wait path...

MAL-2026-14242 Malicious code in electro-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7c16137bdd5ac7c97d450fb8ff77103d9c6421f78848b1017f84348c6ec3762 [email protected] presents itself as 'Session utilities' 170-byte README but ships 1MB of heavily obfuscated JavaScript under dist/ index.js,...

Malicious code in electro-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7c16137bdd5ac7c97d450fb8ff77103d9c6421f78848b1017f84348c6ec3762 [email protected] presents itself as 'Session utilities' 170-byte README but ships 1MB of heavily obfuscated JavaScript under dist/ index.js,...

crucible

Crucible AI-Driven Automated Vulnerability Verification Pla...

Malicious code in streak-metric-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77 [email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs...