CVE-2026-84623: Improper Authentication

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An app may be able to fingerprint the device...

CVE-2026-75945: Incomplete Cleanup

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued...

CVE-2026-77191: Missing Authorization

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...

CVE-2026-13107: Improper Restriction of XML External Entity Reference

IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection attacks by default...

CVE-2023-22631: Improper Neutralization of Argument Delimiters in a Command

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

CVE-2026-75944: Incomplete Cleanup

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction an AclAgent restart by an...

CVE-2026-75943: Incomplete Cleanup

A brief milliseconds to seconds traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement...

CVE-2026-84576: Exposure of Sensitive Information to an Unauthorized Actor

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...

CVE-2026-16435: Trusting HTTP Permission Methods on the Server Side

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features...

Command Path Injection

This plugin identifies PATH environment variables either at the system or user level that could be leveraged by a local attacker for path based command injection. Path command injection happens when a PATH places user controlled directories, relative paths or world writable directories ahead of...

sakuda

sakuda sakuda is short for 「さくっとDAST」 "DAST, quickly...

CVE-2025-45480: Incorrect Resource Transfer Between Spheres

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary...

CVE-2026-29810: Detection of Error Condition Without Action

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2025-70820: Absolute Path Traversal

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2026-29811: Comparison Using Wrong Factors

CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...

CVE-2026-90525: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

CVE-2026-90490: Deserialization of Untrusted Data

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be...

CVE-2026-90773: Improper Neutralization of Escape, Meta, or Control Sequences

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

CVE-2026-49030: Undefined Security Weakness

pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join, resolve, and normalize to interpret backslash-separated dot notation sequences as directory traversal,...

mzap v2.2.1

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...