Exploit for Authentication Bypass by Spoofing in Ivanti Connect_Secure

CVE-2026-104935 — Ivanti Connect Secure / Pulse Secure RCE Exp...

cyberpanel-poc

CyberPanel v2.4 — Authenticated Privilege Escalation Chain...

[SECURITY] Fedora 43 Update: rust-webpki-roots-1.0.10-1.fc43

Mozilla's CA root certificates for use with webpki...

[SECURITY] Fedora 43 Update: rust-webpki-root-certs-1.0.10-1.fc43

Mozilla trusted certificate authorities in self-signed X.509 format for use with crates other than webpki...

CLEANSTART-2026-WR32003 On Windows, when the target of Root

CVE-2026-56857 affects multiple packages. On Windows, when the target of Root. See references for individual vulnerability details...

Malicious code in @sudobility/indexer_client (npm)

Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from https://amplify-gursha-dev-121835-deployment.s3.amazonaws.com/ a presigned S3 URL embedding...

Malicious code in @sudobility/shaperouter_client (npm)

Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using a presigned URL embedded AWS access key id ,...

Malicious code in @sudobility/testomniac_client (npm)

Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com using an embedded A...

PT-2026-121682

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

PT-2026-135235

update to CKBI 2.92 from NSS 3.131.1 - updated certificates: - Certificate "OISTE Server Root RSA G1" - Certificate "Amazon Root CA 1" - Certificate "Amazon Root CA 2" - Certificate "Amazon Root CA 3" - Certificate "Amazon Root CA 4" - Certificate "GlobalSign ECC Root CA - R4" - Certificate "GTS...

...[ More ]

NetScaler ADC and Gateway 13.1 before build 64.23 and 14.1 before build 73.37 copy an unauthenticated failed-login username into system logs. During a later diagnostic run, nsmonuploadderr.pl mistakes a crafted login record for a packet-engine failure and inserts attacker-controlled text into a...

KiloView E3 firmware command injection vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a command injection vulnerability. This flaw arises because the hostname parameter received by the device’s naming endpoint is passed directly into shell commands without proper quotation marks. As a result, authenticated web users may...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a flaw in authentication mechanisms on affected interfaces, allowing unauthenticated remote attackers to bypass existing authentication checks and execute arbitrary commands on the underlying host. Successful exploitation of this...

Bytecode Alliance wasmtime resource management error vulnerability

In versions prior to 48.0.4 of Bytecode Alliance Wasmtime, as well as versions prior to 49.0.0 but prior to 49.0.2, there is a resource management error vulnerability. This vulnerability arises because the GC root protection is missing in trycall calls when compiling Wasm modules. An attacker can...

KiloView E3 firmware command injection vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a command injection vulnerability. This flaw arises because network management services fail to clear a field used when configuring static routes via the web administration API. Web users who are authenticated and possess static route...

PT-2026-121589

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description An issue in the affected interface allows an unauthenticated remote attacker to bypass authentication controls and execute arbitrary commands as root on the underlying operating system,...

PT-2026-121537

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.4 OpenBao versions 2.7.x prior to 2.7.1 Description Failure to write response audit entries occurs for the unauthenticated 'sys/generate-root', 'sys/rekey', and 'sys/rekey-recovery-key' endpoints when request audi...

PT-2026-134889

This update for ca-certificates-mozilla fixes the following issue: Updated to 2.92 state bsc1286261 Removed: - emSign ECC Root CA - C3 - emSign ECC Root CA - G3 - emSign Root CA - C1...

Palo Alto GlobalProtect App MacOS 6.2.x < 6.2.8-h15 / 6.3.x < 6.3.3-h16 Local Privilege Escalation (CVE-2026-0315)

The version of Palo Alto GlobalProtect App installed on the remote macOS host is 6.2.x prior to 6.2.8-h15, or 6.3.x prior to 6.3.3-h16. It is, therefore, affected by a local privilege escalation vulnerability: - A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect ap...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : NSS update (USN-8947-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8947-1 advisory. This update removes the emSign ECC Root CA - G3 and Comodo AAA Services root CA...