libcurl: libcurl: Information disclosure via cached SSL session and early data

A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. When libcurl attempts a second transfer to the same site with a cached SSL session and early data enabled, it may send sensitive request data before verifying the server's...

CVE-2026-65609 Out-of-bounds write in nnn

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

EUVD-2026-62398

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

CVE-2026-65609

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

CVE-2026-65609 Out-of-bounds write in nnn

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

CVE-2026-65609

nnn (a terminal file manager) is vulnerable to an out-of-bounds write caused by insufficient validation of attacker-controlled length fields when deserializing a session file. Loading a crafted session file with the -s option allows an attacker who can place a file in the victim's nnn session dir...

CVE-2026-65609

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

CVE-2026-65609 Out-of-bounds write in nnn

nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack of validation of attacker-controlled length fields deserialized from a session file, a crafted session file can cause nnn to write data beyond the bounds of fixed-size global buffers when loaded with the -s option. An attacker who...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

databricks-session (0.1.11) potentially affected by CVE-2026-64849 via mlflow (2.3.0)

mlflow PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session 0.1.11 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...

PYSEC-2026-3688 MobSF's CSRF checks not enforced after Django migration

Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

PYSEC-2026-3702 tablib: Stored XSS in the HTML export via unescaped dataset title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

K000162984: Node.js vulnerabilities CVE-2026-58039 and CVE-2026-58040

Security Advisory Description CVE-2026-58039 A flaw in Node.js Permission Model enforcement allows process.report writes and overwrites files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This...

Malicious code in electro-session (npm)

Source: amazon-inspector e7c16137bdd5ac7c97d450fb8ff77103d9c6421f78848b1017f84348c6ec3762 [email protected] presents itself as 'Session utilities' 170-byte README but ships 1MB of heavily obfuscated JavaScript under dist/ index.js, cli.js, run-once.js, schedule.js, all produced by...

Malicious code in ranux-dev (npm)

Source: amazon-inspector 4dde928a7de2064f13b18847a56607605bd33f1331a57bb0be0ccf585fa5d86f package.json declares the dependency @whiskeysockets/baileys but resolves it from github:rcedubot/X instead of the npm registry. Installing ranux-dev pulls arbitrary, unpinned, mutable code from that persona...

CVE-2026-19056

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-18031

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...

Malicious code in electron-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb868700350bb9700f3419a058a7802293ac0e39212ecd0c9f16eddb9e0af769 Package published as electron-sessions advertises itself as generic 'Session utilities' but ships a single 1.18MB heavily obfuscated dist/index.js...

CVE-2026-19056

The ProSolution WP Client WordPress plugin (versions before 2.0.11 ) is vulnerable to reflected Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages. An atta...

EUVD-2026-62287

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...