Medium: docker

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Medium: docker

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Amazon Linux 2 : oci-add-hooks (ALASDOCKER-2026-147)

The version of oci-add-hooks installed on the remote host is prior to 0-0.11.20200504git325a340. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-147 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outsid...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2026-3180)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3180 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Medium: amazon-ecr-credential-helper

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

nanoclaw

Un asistente de IA que ejecuta agentes de forma segura en sus propios contenedores. Ligero, diseñado para ser fácilmente comprensible y completamente personalizable según tus necesidades. nanoclaw.dev • docs • 中文 • 日本語 • 한국어 • • Agentes en Slack: una app por agente La configuración aprovisiona a...

CVE-2026-104680

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does n...

CVE-2026-88930 Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88930

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to SQL injection attacks. The root cause is twofold: the plugin fails to require a shared secret before accepting authorized requests, and it fails to properly sanitise and escape a parameter used in an SQL statement. ...

pmkidcracker

Crackeador de PMKID WPA2 Este programa es una herramienta escrita en Python para recuperar la clave precompartida de una red WiFi WPA2 sin necesidad de desautenticación ni requerir que haya clientes en la red. Aprovecha la debilidad de ciertos puntos de acceso que anuncian el valor PMKID en el...

ike-scan

ike-scan Descubrir e identificar hosts IKE Servidores VPN IPsec Tabla de Contenidos Construcción e Instalación Resumen Uso Detalles de Implementación Entrada de Hosts y Requisitos de Memoria Limitación de Tasa Generación de Cookies e Identificación de Hosts Remotos Detalles de Paquetes IKE...

xed

Intel® X86 Encoder Decoder Intel® XED Doxygen-API-Handbuch und Quellcode-Build-Handbuch: https://intelxed.github.io Fehler: https://github.com/intelxed/xed/issues/new Abgekürzte GITHUB -Build-Anleitung: git clone https://github.com/intelxed/xed.git xed git clone...

PT-2026-110147

Name of the Vulnerable Software and Affected Versions CloudBeaver versions prior to 25.3.6 Description A missing authorization issue exists in the WebSQLResultServlet endpoint. This allows any user with a valid web session to access LOB Large Object export files belonging to other users stored in...

CVE-2026-104680: Improper Privilege Management

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress plugin before 1.16.2 code before processing its setup-wizard Envira Gallery WordPress plugin before 1.16.2-installation request, and does n...

Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1791734079)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791734079 advisory. - Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key...

CVE-2026-108745: Missing Authorization

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims...

CVE-2026-108547

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

EUVD-2026-96342

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

CVE-2026-108547 AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...

CVE-2026-108547 AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var

AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted...