PT-2026-85567

Name of the Vulnerable Software and Affected Versions aider versions 0 through 0.86.2 Description The software automatically loads a .aider.conf.yml configuration file from the root of the git repository where it is launched. An attacker can craft a repository containing a malicious configuration...

CVE-2026-85674: Improper Control of Generation of Code

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

Faraday 5.24.0

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

secbench-dvwa

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

MAL-2026-15834 Malicious code in apple-internal-test-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f166ea5f034867eae7d9bdc6f82b50c40a22b5237c6e591953d73947dd43244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple-internal-test-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f166ea5f034867eae7d9bdc6f82b50c40a22b5237c6e591953d73947dd43244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-90886

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERR PTR to kthread stop In test ringbuffer's out free cleanup loop, the check !rb threadscpu only catches NULL entries and misses entries that hold an ERR PTR. rb threads is static, so unassigned...

CICD-Goat-Vapt-Writeup — Updated!

CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...

Malicious Package

Overview apple-internal-test-utility is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview arno-baidu-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-42425

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig routes...

Towards Behavior Tree-Guided Vulnerability Detection with Lightweight LLMs

Large Language Models LLMs are increasingly used for software vulnerability detection, but their performance depends on how source code is represented in the input. Most prompting approaches use source code in its original form, while some works propose the use of structured representations...

[SECURITY] [DLA 4764-2] libdbd-csv-perl regression update

Debian LTS Advisory DLA-4764-2 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 31, 2026 https://wiki.debian.org/LTS Package : libdbd-csv-perl Version : 0.5800-1+deb11u1 0.6000-1+deb12u1 Debian Bug : 1139509 The security fix for CVE-2026-15392 symlink escape ...

CVE-2026-61638 Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-80639

A flaw was found in the Linux kernel's cxl/test module. A buffer overflow vulnerability, a type of memory corruption, exists within the setupxormapping function. This flaw could allow a local user to trigger a runtime assertion failure, potentially leading to system instability or a denial of...

PT-2026-83991

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.6 Description An authenticated user can perform Server-Side Request Forgery SSRF, a flaw where the server is tricked into making requests to an unintended location, allowing the probing of internal networks and clo...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-51152

The software QD (versions 20220208 through 20250803) is vulnerable to a Server-side request forgery (SSRF) in the /har/test endpoint. The root cause is located in Fetcher.build_request() within libs/fetcher.py , which constructs an httpclient.HTTPRequest from user-supplied JSON without validating...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...