idb

Idb idb is a tool to simplify some common tasks for iOS pentesting and research. Originally there was a command line version of the tool, but it is no longer under development so you should get the GUI version. idb has a new homepage athttp://www.idbtool.com All documentation and news are posted...

CVE-2026-120636

A flaw was found in perl-cgi. The component constructs target URLs and form actions from client-supplied request values without sufficient validation. A remote attacker can exploit this flaw by sending a specially crafted request URI Uniform Resource Identifier containing arbitrary domains or...

CLEANSTART-2025-FI55588 LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server

Security vulnerability affects the libreoffice package. LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server...

CVE-2024-38200

CVE-2024-38200 After The Patch Capturing the NTLMv2 hash over HTTP method was not fixed. The NTLMv2 hash value can still be obtained over HTTP and relayed to LDAP or ADCS. MSRC stated this situation as "as presented this looks to be part of the current design." Even if this vulnerability is fixed...

CLEANSTART-2024-UF89680 Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincip...

Security vulnerability affects the firefox-esr package. Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals...

CLEANSTART-2024-MS76796 website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL

Security vulnerability affects the firefox-esr package. A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL...

CVE-2026-116796

A flaw was found in Highcharts. An attacker who can supply chart text configurations can execute arbitrary script in a victim's browser session. The library fails to validate URL schemes on certain Scalable Vector Graphics SVG anchor link attributes, allowing malicious JavaScript links to persist...

EUVD-2026-104813

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization...

K000163832: Linux kernel vulnerability CVE-2026-46121

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcgpath kfree with damonsysfslock Patch series "mm/damon/sysfs-schemes: fix use-after-free for memcgpath". Reads of 'memcgpath' and 'path' files in DAMON sysfs...

Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in accesspatternadddirs Patch series “mm/damon/sysfs-schemes: fix wrong directories put orders in error paths”. The error paths of the damonsysfsaccesspatternadddirs and...

Astra Linux – Vulnerability in python-reportlab

All versions of the reportlab package are vulnerable to Server-side Request Forgery SSRF via img tags. To reduce this risk, use trustedSchemes and trustedHosts see Reportlab’s documentation. Steps to reproduce by Karan Bamal: 1. Download and install the latest version of the reportlab package. 2...

CVE-2026-102982

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the lin...

CVE-2026-102982

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in commenthtml. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the lin...

PT-2026-111650

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the...

CVE-2026-92862

The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...

CVE-2026-92862

The Android application Ticket Ryutsu Center is vulnerable to an improper handling of custom URL schemes (CWE-939). A malicious application can leverage a crafted Intent to force the vulnerable application to access an arbitrary website. No specific patch version or remediation is provided in the...

EUVD-2026-94676

The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...

CVE-2026-92862

The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...

CVE-2026-92862

The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent...