29266 matches found
MAL-2026-4226 Malicious code in tailwindcss-themers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 091ab8da12c1de90002f159fc2db723d4c26b0bc66247c3278f4d07e159ae8c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-44062
creationtimestamp| type| source ---|---|--- 2026-05-21 10:22:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mme76734nx2i 2026-05-22 07:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmgef3qb4h2z...
CVE-2026-9144
creationtimestamp| type| source ---|---|--- 2026-05-20 21:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcsfpa4pg2c...
CVE-2026-35015
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in dounitmail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the theticket GET parameter directly into a JavaScript variable assignment. Attacker...
CVE-2026-35015 Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in dounitmail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the theticket GET parameter directly into a JavaScript variable assignment. Attacker...
CVE-2026-35015
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in dounitmail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the theticket GET parameter directly into a JavaScript variable assignment. Attacker...
CVE-2026-35015 Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in dounitmail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the theticket GET parameter directly into a JavaScript variable assignment. Attacker...
CVE-2026-35015
Open ISES Tickets before 3.44.2 is vulnerable to a reflected XSS in do_unit_mail.php via the_ticket parameter. An authenticated attacker can inject arbitrary JavaScript by passing an unsanitized value into the_ticket, which is then inserted into a JavaScript variable assignment and executed when ...
CVE-2026-24218
NVIDIA DGX OS contains a vulnerability in the factory provisioning process, where the cloning of a base image causes identical SSH host keys to be deployed across multiple systems. The sharing of cryptographic identifiers across all similarly provisioned systems enables host impersonation or...
Astra Linux – Vulnerability in Thunderbird
When loading the shared library that provides the OTR protocol implementation, Thunderbird initially attempts to open it using a filename that is not distributed by Thunderbird. If a computer has already been infected with a malicious library from the alternative filename, and the malicious libra...
Astra Linux – Vulnerability in curl
When curl version 7.20.0 or later connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can send multiple responses at once, which are cached by curl. In this case, curl upgrades to TLS, but it does not discard the cached responses. Instead, it...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation of Omnibox in Google Chrome prior to version 99.0.4844.51 allowed an attacker with privileged network access to perform a man-in-the-middle attack through malicious network traffic. Chromium security severity: Low...
Astra Linux – Vulnerability in curl
When curl 7.84.0 performs FTP transfers secured by krb5, it incorrectly handles message verification failures. This flaw allows a Man-In-The-Middle attack to go unnoticed, and even enables the attacker to inject data into the client’s system...
Astra Linux – Vulnerability in binutils
A flaw was discovered in Binutils. The thebfd field of the asymbol struct is uninitialized in the bfdmachogetsyntheticsymtab function, which may lead to an application crash and local denial of service...
Astra Linux – Vulnerability in PostgresSQL 11
A man-in-the-middle attacker can inject false responses to the client’s first few queries, despite the use of SSL certificate verification and encryption...
CVE-2026-7467
creationtimestamp| type| source ---|---|--- 2026-05-20 03:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmavzfajg62w 2026-05-20 05:21:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmb5vdvtdn2p 2026-05-20 11:32:08+00:00| seen|...
Metasploitable3-pentest-lab
🛡️ Metasploitable3 — Home Lab Penetration Test Report Aut...
Advisory ROSA-SA-2026-3269
software: angie 1.11.5 AXIS: ROSA-CHROME unaffected versions = angie-1.11.5-1 affected versions angie-1.11.5-1 CVE-ID: CVE-2026-42945 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A heap buffer overflow vulnerability in the ngxhttprewritemodule NGINX Plus and NGINX Open Source module allows an...
CVE-2026-8719
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be...