PT-2026-5836

Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths without authentication. Attackers can exploit the vulnerability by manipulating path parameters in GET and POST requests to list or download...

PT-2026-6275

Name of the Vulnerable Software and Affected Versions Qwik versions prior to 1.19.0 Description Qwik is a performance focused javascript framework. A prototype pollution issue exists in the formToObj function within the @builder.io/qwik-city middleware. The function processes form field names usi...

PT-2026-5904

Name of the Vulnerable Software and Affected Versions HCL AION version 2.0 Description HCL AION is susceptible to a cookie handling issue where cookies may lack proper SameSite attributes, or have insecure or improper configurations. This can allow cookies to be transmitted in unintended cross-si...

Open eClass 跨站请求伪造漏洞

Open eClass is an open-source e-classroom system developed by the Greek Universities Network. Versions of Open eClass prior to 4.2 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from cross-site request forgery occurring at multiple teacher-restricted endpoints,...

Linux Distros Unpatched Vulnerability : CVE-2026-1035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse...

PT-2026-5839

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0 Description School ERP Pro version 1.0 contains a SQL injection issue in the es messagesid parameter. Attackers can manipulate database queries through GET requests by injecting crafted SQL statements. This could all...

pearweb 安全漏洞

PearWeb is a PHP extension and application repository developed by PEAR. Versions prior to pearweb1.33.0 contained security vulnerabilities. These vulnerabilities stemmed from predictable verification hashing, which could allow attackers to guess verification tokens and potentially unauthorized...

Netis E1+ 安全漏洞

Netis E1+ is a wireless signal amplifier developed by the Chinese company Netis. Version 1.2.32533 of Netis E1+ contains a security vulnerability. This vulnerability stems from an information leakage flaw, allowing attackers to send GET requests to the netcoreget.cgi endpoint, potentially leading...

Rubikon Easy Transfer 路径遍历漏洞

Rubikon Easy Transfer is a file transfer application developed by Rubikon Corporation. Version 1.7 of Rubikon Easy Transfer contains a path traversal vulnerability. This vulnerability stems from directory traversal vulnerabilities, allowing attackers to access unauthorized file system paths by...

CVE-2026-24040 jsPDF has a Shared State Race Condition in addJS Plugin

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable text to store JavaScript content. When used in a concurrent environment e.g., a Node.js web server, this variable is shared across all requests. ...

CVE-2026-24040

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable text to store JavaScript content. When used in a concurrent environment e.g., a Node.js web server, this variable is shared across all requests. ...

Race Condition

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Race Condition in the addJS function due to the use of a shared module-scoped variable for storing JavaScript content. An attacker can cause sensitive data intended for one user to be...

Server-side Request Forgery (SSRF)

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation of the backchannelclientnotificationendpoint,...

Keycloak Server-Side Request Forgery (SSRF) vulnerability

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services...

CVE-2026-1518

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlle...

CVE-2026-1518

CVE-2026-1518 is marked as rejected in the public CVE feed. Connected documents, however, describe a Keycloak SSRF issue via the CIBA backchannel notification endpoint . The vulnerability arises from insufficient validation of the client-configured backchannel_notification_endpoint during client ...

CVE-2026-1518

DO NOT USE THIS CANDIDATE NUMBER. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality,...

MAL-2026-641 Malicious code in connections-api-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5d9023bd1b2434b0519e9f26fe6d776297700ef0d80c05ba50ead13c6e3d61bb Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in connections-api-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5d9023bd1b2434b0519e9f26fe6d776297700ef0d80c05ba50ead13c6e3d61bb Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-639 Malicious code in connection-api-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1e1edf0790733aa25ad085b523a095b1ee4abee84eca696bbcaf1682cca2c2ad Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...