CVE-2026-55742 Cotonti CSRF in admin.rights.php allows privilege escalation

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action 'a=update' modifies group access rights including via cotauthaddgroup without calling cotcheckxg to validate th...

dotnet: .NET: Local file tampering via link following vulnerability

A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issu...

CVE-2026-40624

creationtimestamp| type| source ---|---|--- 2026-06-18 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-01 2026-06-19 04:03:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3momhk3tmue2g 2026-06-19 05:01:02+00:00| seen|...

MAL-2026-6094 Malicious code in metrics-probe-f256 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fdf2b93d50f09ea1b087bdc33578fedec5483e75c7a9acd61355cc02f9f7ec0 Package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that executes run.js automatically on npm install. run.js...

MAL-2026-6106 Malicious code in @ncurran/sandbox-recon-9b2d4f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e26a43461da776d8145183e606db9c9bdbfaa1a053e76c44ce1f78ec1364ec1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-48523 vulnerabilities

Vulnerabilities for packages: ggshield, kserve, datadog-agent, superset...

SUSE CVE-2026-12460

Insufficient policy enforcement in File System Access in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: High...

PT-2026-50674

Name of the Vulnerable Software and Affected Versions Docker Sandboxes sbx affected versions not specified Description Docker Sandboxes sbx implements an egress allowlist restricted to HTTP/S traffic but fails to apply this restriction to DNS resolution. The embedded DNS server for each network...

PT-2026-50703

Name of the Vulnerable Software and Affected Versions U.S. GAO Electronic Protest Docketing System EPDS affected versions not specified U.S. CBCA Electronic Docketing System EDS affected versions not specified Description The U.S. Government Accountability Office GAO Electronic Protest Docketing...

Critical Photon OS Security Update - PHSA-2026-5.0-0886

Updates of 'samba-client', 'nano', 'libsolv' packages of Photon OS have been released...

Siemens RuggedCom Rox Out-of-bounds Write (CVE-2019-14194)

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfsreadreply when calling storeblock in the NFSv2 case. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Debian dla-4633 : fonts-opensymbol - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4633 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4633-1 [email protected]...

Siemens RuggedCom Rox Out-of-bounds Write (CVE-2019-14203)

An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfshandler reply helper function: nfsmountreply. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

PT-2026-50658

Name of the Vulnerable Software and Affected Versions ibaPDA affected versions not specified ibaDatCoordinator affected versions not specified Description Remote, unauthenticated attackers can exploit a deserialization of untrusted data issue to achieve remote code execution, potentially gaining...

PT-2026-50777

Name of the Vulnerable Software and Affected Versions NILFS utilities versions prior to 2.3.1 Description The nilfs sb is valid function fails to validate the s log block size field in the NILFS2 superblock before performing bit-shift operations. An attacker can provide crafted NILFS2 images to...

Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-71190)

In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind. This plugin only works with Tenable.ot. Please visit...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0886

Updates of 'samba-client', 'libsolv', 'nano' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2026-5.0-92-0884

Updates of 'freetype2' packages of Photon OS have been released...

PT-2026-50691

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.71.0 Description Files matching the pattern .prompts/.prompttemplate in a workspace are automatically loaded, allowing them to override or extend the AI agent's system prompts. This enables indirect prompt...

PT-2026-50706

Name of the Vulnerable Software and Affected Versions U.S. GAO Electronic Protest Docketing System EPDS affected versions not specified U.S. CBCA Electronic Docketing System EDS affected versions not specified Description The U.S. Government Accountability Office GAO Electronic Protest Docketing...