Siemens COMOS permission licensing and access control vulnerabilities

Siemens Comos is a factory engineering software solution developed by the German company Siemens. Siemens COMOS has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from an insecure search path within the IAM Client SDK. Attackers can exploit these...

PT-2026-62087

Name of the Vulnerable Software and Affected Versions Crocus version 1.3.44 Description A SQL injection flaw allows a remote attacker to escalate privileges. This issue occurs through the RecordStateMapper.xml file. SQL injection is a technique where malicious SQL statements are inserted into ent...

PT-2026-61946

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits...

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file...

PT-2026-62176

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Application Interface. Supported versions that are affected are 17.0-26.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment...

Linux Distros Unpatched Vulnerability : CVE-2026-49145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current...

CVE-2026-56584: Exposure of Sensitive Information to an Unauthorized Actor

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits...

CVE-2026-30632

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the createdoc tool...

CVE-2026-47128

The CVE concerns the nono sandbox tool (pre-0.55.0) where Landlock/seccomp policies allowed access to local Unix domain sockets (concrete and abstract). This enabled sandbox escape by contacting the per-user systemd DBus socket, with the root cause being incomplete mediation of local IPC. Impact ...

CVE-2026-47128 nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

CVE-2026-47128 nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

CVE-2026-47128

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

CVE-2026-47128 nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the handling of Proxy-Authorization headers by the cURL handlers and stream handler. An attacker can obtain proxy credentials by controlling the origin server and capturing the credentials sent...

CVE-2026-16324

CVE-2026-16324 affects Metasoft MetaCRM up to version 6.4.0 Beta06. The vulnerable component is an unknown function in the file /business/qnaire/upload.jsp, where manipulation of the argument File enables unrestricted file upload. Attacks may be launched remotely, and the exploit is publicly avai...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently...

CVE-2026-48389 DNG SDK | Stack-based Buffer Overflow (CWE-121)

DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Malicious code in tilaver-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...

EUVD-2026-46013

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...