CVE-2023-20198-Exploit

Cisco IOS XE Authentication Bypass CVE-2023-20198 This repository contains a proof-of-concept exploit for CVE-2023-20198 , an authentication bypass vulnerability affecting Cisco IOS XE Web UI. The vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable Cisco...

raink

Use LLMs for document ranking. Description There's power in AI in that you can "throw a problem at it" and get some result, without even fully defining the problem. For example, give it a bunch of code diffs and a security advisory, and ask, "Which of these diffs seems most likely to fix the...

CVE-2026-83539: Apache Software Foundation Apache Wicket: Improper neutralization of input during web page generation in Apache Wicket

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escap...

PT-2026-135046

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.19.0 Apache Wicket versions 9.0.0 through 9.24.0 Apache Wicket versions 10.0.0 through 10.11.0 Description Improper neutralization of input during web page generation occurs when the...

CVE-2026-120274: beecue FastBee: A vulnerability was identified in beecue FastBee up to 2.1.0

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

PT-2026-135037

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

PT-2026-135044

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.18.0 through 8.19.0 Apache Wicket versions 9.23.0 through 9.24.0 Apache Wicket versions 10.9.0 through 10.11.0 Description Session fixation exists in the role-based security module. The signInString, String method in t...

PT-2026-135054

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

PT-2026-135043

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:22196-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22196-1 advisory. Changes in python-Django: - CVE-2026-87975: an authenticated user permitted to submit a formset to delete rows outside the limiting queryset,...

Fedora 44 : rust-gst-plugin-reqwest (2026-857be6ce3c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-857be6ce3c advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Fedora 43 : openscap (2026-03caed4282)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-03caed4282 advisory. Update to the latest upstream release Vulnerability fix - CVE-2026-85518: Fix path traversal when dumping SDS components Maintenance, bug fix - Lock testfile...

openSUSE 16 Security Update : expat (openSUSE-SU-2026:22177-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22177-1 advisory. - CVE-2026-77214: out-of-bounds read due to insufficient checks in XMLParseBuffer bsc1284334. - CVE-2026-93990: fails to validate low surrogates...

CentOS Linux 6 [TuxCare] Security Update: icu / libicu / libicu-devel / libicu-doc (CENTOS6:CLSA-2026:1793167763)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793167763 advisory. - A stack buffer overflow was found in Internationl components for unicode ICU . While running the genrb binary, the 'subtag' struct overflowed a...

Linux Distros Unpatched Vulnerability : CVE-2026-120246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM...

Rocky Linux 8.6 [CIQ] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (ciqsa-2026_1742)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261742 advisory. This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 8.6. It addresses 21 CVEs: CVE-2025-26465, CVE-2026-35388, CVE-2026-59999,...

CentOS Linux 7 [TuxCare] Security Update: libvirt / libvirt-admin / libvirt-bash-completion / libvirt-client / etc (CENTOS7:CLSA-2026:1793178380)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793178380 advisory. - A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following...

Linux Distros Unpatched Vulnerability : CVE-2026-119374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete that allows attackers to write past the leaf page buffer via crafted...

openSUSE 16 Security Update : perl-Dancer2-Plugin-Auth-Extensible (openSUSE-SU-2026:22190-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22190-1 advisory. Changes in perl-Dancer2-Plugin-Auth-Extensible: - updated to 0.714.0 0.714 Fix failing tests when sendmail binary not present on system. - updated to...

Fedora 45 : nicotine+ (2026-4b6e8bed0f)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4b6e8bed0f advisory. Version 3.3.11 September 16, 2026 Changes Added menu items for moving column headers due to broken drag-and-drop in GTK Enabled fixed number of upload slots ...