AbxOverflow

Fixes for issue described here appeared under CVE-2024-34740 / A-307288067: Bulletin Patch linked from bulletin Two other patches: 1 2 Android Binary XML Inside Android systemserver, many services store their state across reboots in XML files $ adb shell su 0 find /data/system -name '.xml' | sort...

IPFire_2.19_RCE_Authenticated

IPFire 2.19 OINKCODE RCE PoC Python proof of concept for the authenticated command-injection vulnerability in IPFire 2.19's ids.cgi page through the OINKCODE parameter. For authorized security testing and training labs only. Run this PoC only against systems that you own or have explicit permissi...

CVE-2020-1350-DoS

CVE-2020-1350 SIGRed - Windows DNS DoS Exploit Credits for the bug are entirely down to Check Point Research @cpresearch who did an incredible writeup of this bug props to @sagitz for the post Their writeup can be found here. This exploit was written by @maxpl0it Quick summary of how it works: 1...

CVE-2023-20198

CVE-2023-20198 An Exploitation script developed to exploit the CVE-2023-20198 Cisco zero day vulnerability on their IOS XE Hackers have been widely exploiting the this vulnerability which creates a 15 level privilege user by bypassing the authentication Which a malicous xml content make this...

CVE-2023-20198-Exploit

Cisco IOS XE Authentication Bypass CVE-2023-20198 This repository contains a proof-of-concept exploit for CVE-2023-20198 , an authentication bypass vulnerability affecting Cisco IOS XE Web UI. The vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable Cisco...

raink

Use LLMs for document ranking. Description There's power in AI in that you can "throw a problem at it" and get some result, without even fully defining the problem. For example, give it a bunch of code diffs and a security advisory, and ask, "Which of these diffs seems most likely to fix the...

CVE-2026-83539: Apache Software Foundation Apache Wicket: Improper neutralization of input during web page generation in Apache Wicket

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escap...

PT-2026-135046

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.19.0 Apache Wicket versions 9.0.0 through 9.24.0 Apache Wicket versions 10.0.0 through 10.11.0 Description Improper neutralization of input during web page generation occurs when the...

CVE-2026-120274: beecue FastBee: A vulnerability was identified in beecue FastBee up to 2.1.0

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

PT-2026-135044

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.18.0 through 8.19.0 Apache Wicket versions 9.23.0 through 9.24.0 Apache Wicket versions 10.9.0 through 10.11.0 Description Session fixation exists in the role-based security module. The signInString, String method in t...

PT-2026-135043

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

Fedora 44 : rust-gst-plugin-reqwest (2026-857be6ce3c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-857be6ce3c advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Fedora 43 : openscap (2026-03caed4282)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-03caed4282 advisory. Update to the latest upstream release Vulnerability fix - CVE-2026-85518: Fix path traversal when dumping SDS components Maintenance, bug fix - Lock testfile...

openSUSE 16 Security Update : expat (openSUSE-SU-2026:22177-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22177-1 advisory. - CVE-2026-77214: out-of-bounds read due to insufficient checks in XMLParseBuffer bsc1284334. - CVE-2026-93990: fails to validate low surrogates...

CentOS Linux 6 [TuxCare] Security Update: icu / libicu / libicu-devel / libicu-doc (CENTOS6:CLSA-2026:1793167763)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793167763 advisory. - A stack buffer overflow was found in Internationl components for unicode ICU . While running the genrb binary, the 'subtag' struct overflowed a...

Rocky Linux 8.6 [CIQ] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (ciqsa-2026_1742)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261742 advisory. This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 8.6. It addresses 21 CVEs: CVE-2025-26465, CVE-2026-35388, CVE-2026-59999,...

CentOS Linux 7 [TuxCare] Security Update: libvirt / libvirt-admin / libvirt-bash-completion / libvirt-client / etc (CENTOS7:CLSA-2026:1793178380)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793178380 advisory. - A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following...

Linux Distros Unpatched Vulnerability : CVE-2026-119374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete that allows attackers to write past the leaf page buffer via crafted...

openSUSE 16 Security Update : perl-Dancer2-Plugin-Auth-Extensible (openSUSE-SU-2026:22190-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22190-1 advisory. Changes in perl-Dancer2-Plugin-Auth-Extensible: - updated to 0.714.0 0.714 Fix failing tests when sendmail binary not present on system. - updated to...

Fedora 45 : nicotine+ (2026-4b6e8bed0f)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4b6e8bed0f advisory. Version 3.3.11 September 16, 2026 Changes Added menu items for moving column headers due to broken drag-and-drop in GTK Enabled fixed number of upload slots ...