CVE-2026-15483

A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function sub41EC14 of the file /goform/toolsnslookup of the component ssi. The manipulation of the argument nslookuptarget leads to buffer overflow. It is possible to initiate the attack remotely. The vendo...

ocaml-opam -- opam install sandbox escape using symlinks

The OCaml Team reports: Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing. Credits: Reporter: "Kate Deplaix" Remediation Developer: "Nathan Rebours" Remediation Reviewer: "Raja Boujbel" Coordinator: "Hannes Mehnert"...

FTP Fetch, Hidden Bind Ipknock TCP Stager

Fetch and execute an x86 payload from an FTP server. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket...

decompress: decompress: path traversal via indexOf containment bypass allows arbitrary file write (bypass of CVE-2020-12265 fix)

A flaw was found in the decompress component. An improper path containment check allows a local attacker to perform directory traversal. This vulnerability, when combined with unvalidated symlink creation, enables an attacker to write arbitrary files to directories outside the intended extraction...

FreeBSD : Apache HttpClient -- misinterpret malformed authority component (fa0c03dd-7c3a-11f1-8dc2-dca632daf43b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fa0c03dd-7c3a-11f1-8dc2-dca632daf43b advisory. Apache Software Foundation reports: Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can...

Malicious code in @wagni_bot/hyperliquid-sdk (npm)

The npm package @wagnibot/hyperliquid-sdk is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycl...

MAL-2026-7015 Malicious code in turbom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64978153f8a987180b6c8e88b5787598ed949a604527f0098271f97d8c66a235 Starting version 1.0.1, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

CVE-2026-49147

creationtimestamp| type| source ---|---|--- 2026-07-08 16:41:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5kreqe252c...

WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mitchell in WordPress Plugin Stock Locations for WooCommerce versions = 3.1.8...

MAL-2026-6979 Malicious code in turbod (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78d60e25c1258021c4fb69a93456c76ef1157be852c7b9dc7165290ca599b0f7 Starting version 1.0.7, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

MAL-2026-6975 Malicious code in oxntime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4d96d9d5b1800042c94a33b8ac459abe42775a2c07e7cbd4ca2f689bdcf141ef The package contains obfuscated code and embedded binary that is executed during the import. The embedded binary targets Android and seems to act as a guard fo...

BIT-PYTHON-MIN-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

BIT-PYTHON-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

BIT-LIBPYTHON-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

CVE-2026-14495 DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

nmap-enumeration-lab

Network Scanning & Host Enumeration with Nmap Host discovery,...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the sftp process when the command sftp server:/path . is executed with a server under attacker control. An attacker can write files outside the intended directory by manipulating file paths sent from the serve...

EUVD-2026-42109

The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers...

PYSEC-2026-1482 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves...

PT-2026-56177

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.0 Description A bug in the /ui/dependencies scheduling graph endpoint allows an authenticated UI user with read permissions on some Dags to enumerate identifiers of other Dags they are not authorized to rea...