PT-2026-66493

Name of the Vulnerable Software and Affected Versions Calico affected versions not specified Description The Application Layer Policy, which uses Dikastes to enforce HTTP rules, does not perform URL path normalization. This allows HTTP requests containing repeated slashes, encoded slashes, or...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Privilege Defined With Unsafe Actions Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3150 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists with...

CVE-2026-6540: Improper Limitation of a Pathname to a Restricted Directory

Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...

CVE-2026-13113 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race conditio...

CVE-2026-13113 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the required approvals due to a race conditio...

owLSM v0.9.0

🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...

PT-2026-65947

Name of the Vulnerable Software and Affected Versions Sony XAV-9500ES affected versions not specified Description An authorization bypass exists in the udev rules of the system. A physically present attacker can connect a crafted USB device to trigger the instantiation of restricted USB device...

(Pwn2Own) Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability

This vulnerability allows physically present attackers to bypass authorization on affected installations on Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the udev rules. A crafted USB device connected to the system can trigg...

so-crates v3.0.0

SO-CRATES Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus A standalone web application for analyzing pcap files, log files, and binary files. Features include Suricata network analysis, YARA binary scanning, Sigma rule detection for logs, and a single-page UI for browsing...

CVE-2026-67173 Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...

MAL-2026-11126 Malicious code in app-sim-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8470a75b327a72623ec4379302a2fc6ecdbaa302acf4fa1e39f1c688103562be package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes fromstr2 and fromstr1 in index.js. fromstr2 fetches...

Antiphishing v30314202504

DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI - WIKI Protect against phishing attacks Functionality This rule is built using malicious URLs and domains involved in phishing attacks. We utilize some community APIs and NRD Newly Registered Domain to construct these...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59556

CVE-2026-59556 : Unauthenticated Cross Site Scripting (XSS) in the WordPress plugin Dynamic Pricing With Discount Rules for WooCommerce (versions

EUVD-2026-49223

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59556 WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.11 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

clawpatrol v0.5.8

clawpatrol The security firewall for agents. Claw Patrol sits between your agents and prod, parses their traffic at the wire, and gates each action against rules you write in HCL. For example, you can block destructive SQL, or pause kubectl delete pod until a human approves it before the request...

CVE-2026-47086

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by minting a URLAUTH token through the GENURLAUTH command. This allows bypassing Access Control Lists ACLs, which are rules that control access to mailboxes. Consequently, an attacker could read mail from any...

Antiphishing v30239084583

DONATE - DASHBOARD VECTORS - CONTRIBUTING - SUBMIT A VECTOR - REST API CTI - WIKI Protect against phishing attacks Functionality This rule is built using malicious URLs and domains involved in phishing attacks. We utilize some community APIs and NRD Newly Registered Domain to construct these...