CVE-2026-23109

A flaw was found in the Linux kernel's writeback subsystem. The waitsbinodes function waits for all pages under writeback, including those from FUSE filesystems that traditionally do not have data integrity semantics. If a faulty FUSE server fails to reply to write requests, sync operations can...

Medium: python-urllib3

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage an...

📄 Online Grievance Redressal Software 2.6 SQL Injection

Online Grievance Redressal Software version 2.6 suffers from a remote SQL injection vulnerability. ============================================================================================================================================= | Title : Online Grievance Redressal Software 2.6 SQL...

TP-Link多款产品 安全漏洞

TP-Link Archer MR200 and other products are WiFi routers produced by the Chinese company TP-Link. Several TP-Link products have security vulnerabilities. These vulnerabilities stem from the direct execution of JavaScript functions like eval without proper checks. Attackers can exploit this to...

OpenSolution Quick.Cart 安全漏洞

OpenSolution Quick.Cart is an online store system developed by the Polish company OpenSolution. Version 6.7 of OpenSolution Quick.Cart contains a security vulnerability, which stems from storing user passwords in plaintext. This vulnerability could allow privileged attackers to access user...

Odin Secure FTP Expert 安全漏洞

Odin Secure FTP Expert is an FTP client software developed by Odin Secure Corporation. Version 7.6.3 of Odin Secure FTP Expert contains a security vulnerability, which stems from improper handling of site information fields, potentially leading to application crashes...

PT-2026-6546

Name of the Vulnerable Software and Affected Versions Quick.Cart version 6.7 Quick.Cart affected versions not specified Description A user's session identifier can be set before authentication in Quick.Cart. The session ID remains consistent even after authentication, allowing an attacker to fixa...

Apple Security Update: watchOS 11.6.2

Apple recommends to install security update watchOS 11.6.2 on devices Apple Watch Series 6 and later...

CVE-2025-69619

A concrete CVE entry CVE-2025-69619 describes a path traversal vulnerability in My Text Editor v1.6.2 that can cause a Denial of Service by writing files to internal storage. The issue stems from path traversal in the editor’s handling of file paths, allowing manipulation to access/modify files o...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: use dstdevrcu in sksetupcaps CVE-2025-40170 In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: add seqadj extension for natted connections CVE-2025-68206 In the Linux kernel...

Debian dsa-6121 : libtomcat11-embed-java - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6121 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6121-1 [email protected] https://www.debian.org/securit...

ChurchCRM SQL Injection Vulnerability (CNVD-2026-12565)

ChurchCRM is ChurchCRM open source an open source CRM system for churches. A SQL injection vulnerability exists in ChurchCRM versions prior to 6.7.2, which stems from the lack of validation of external input SQL statements in the PerID parameter in the /PaddleNumEditor.php endpoint. An attacker c...

CVE-2026-25584

creationtimestamp| type| source ---|---|--- 2026-02-04 22:17:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2vpwhl3j23 2026-02-04 22:17:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2vqlgsmw2o...

CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

EUVD-2024-55395

IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 on CP4D 4.8, 7.7 on CP4D 5.0, and 7.8 on CP4D 5.1 do not properly limit the allocation of system resources. An authenticated user with internal knowledge of the environment could exploit this weakness to cause a denial of service...

EUVD-2025-206778

A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hssogsdiamcxmarcb of the file src/hss/hss-cx-path.c of the component VoLTE Cx-Test. The manipulation of the argument OGSKEYLEN results in stack-based buffer overflow. The attack may be...

CVE-2026-0536

creationtimestamp| type| source ---|---|--- 2026-02-04 19:17:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2lnko56g23...

CVE-2026-23078

creationtimestamp| type| source ---|---|--- 2026-02-04 17:25:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116013525368336436 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-07 18:00:00+00:00| seen|...

CVE-2026-20401

creationtimestamp| type| source ---|---|--- 2026-02-04 15:17:07+00:00| seen| Telegram/dDHVryIUgTB0bl9EUy2cYsSqKLSHmbXCLC2CE7zqR15ujSM...

CVE-2025-14461

The CVE describes unauthenticated order-status manipulation in the Xendit Payment plugin for WordPress (WooCommerce integration). Versions up to and including 6.0.2 expose a publicly accessible API callback endpoint (wc_xendit_callback) that processes payment callbacks without authenticating orig...