CVE-2026-64850

In Grav prior to 2.0.7, Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php passes an editor-controlled callable to call_user_func_array() without filtering dangerous callbacks. A user with admin.pages or api.pages.write privileges can use arrayFilterRecursive() as a trampoline ...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

frida v17.17.0

Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at frida.re. Two ways to install 1. Install from prebuilt binaries This is the recommended way to get started. All you need to do is: root@kitploit: pip install frida-tools CLI tools pip...

Important: Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 security update

An update for multiple packages is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

MAL-2026-14310 Malicious code in bunnyhijack-test-0x00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e package.json declares "bin": "node": "./shim.js" , which causes npm to place a node executable into nodemodules/.bin. Since nodemodules/.bin is...

Malicious code in bunnyhijack-test-0x00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e package.json declares "bin": "node": "./shim.js" , which causes npm to place a node executable into nodemodules/.bin. Since nodemodules/.bin is...

CVE-2026-71961

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The synccommand binary forwards unsanitized...

CVE-2026-71176

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2026-67266

Dell Command Update DCU, versions prior to 5.7.1, contain an Incorrect Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-67268

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery...

CVE-2026-67267

Dell Command Update DCU, versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-58565

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-58564

Dell Command Update DCU, versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

CVE-2026-58562

Dell Command Update DCU, versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-56796

Dell Command Update DCU, versions prior to 5.7.1, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-56797

Dell Command Update DCU, versions prior to 5.7.1, a Time-of-check Time-of-use TOCTOU Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-53451

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to...

CVE-2026-53477

Dell Command Update DCU, versions prior to 5.7.1, contain a Time-of-check Time-of-use TOCTOU Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-53452

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command accepts a recordingPath for the sigmf-playback SDR and backend/handlers/entities/sdr.py stores it...