33866 matches found
Malicious code in @react-case/option (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beffda94b8ea554f153faaf508da7906f78d821d45d2fca7b7b61180740269 The package's main entrypoint index.js is heavily obfuscated with a string-array + RC4-style decoder that reconstructs all API names and the target U...
EUVD-2026-44531
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...
CVE-2025-56364
creationtimestamp| type| source ---|---|--- 2026-07-15 00:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqng325btt2z 2026-07-27 08:48:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmj6r7uog2m 2026-07-27 08:53:06+00:00| seen|...
CVE-2026-61371
Microsoft AVML versions prior to 0.17.0 are vulnerable to a truncation-before-validation flaw on Unix systems. The software can follow a symlink when opening a destination output path, enabling an attacker to trigger a destructive truncation or overwrite of the symlink target. This occurs at open...
Vulnerability of the WebRTC technology implementation: The networking capabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.
Vulnerability of WebRTC technology implementation: The networking of Mozilla Firefox, Firefox ESR, and the email client Thunderbird relies on copying buffers without checking the size of input data. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...
PT-2026-60122
Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing...
PT-2026-60136
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78 Description A server-side request forgery SSRF issue exists in the web crawl tool. The software validates hostnames at check time using the is safe crawl url function to reject private, loopback, or link-loca...
PT-2026-58896
Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An authenticated user with permissions to view offices can perform a time-based blind SQL injection via the 'Office Search API' endpoint '/api/v1/offices'. The issue occurs because the order...
PT-2026-60265
TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString checks space for only one byte before processing SQL string escape sequences %, , or x, allowing a one-byte out-of-bounds write to the sta...
PT-2026-60266
TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side...
PT-2026-60370
Unvalidated note type Parameter in mc issue update SOAP Endpoint Allows creation of TIME TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note type integer directly to bugnote add without validating that the user is authorized to create that type of note. If the user's access...
CVE-2026-57821: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...
PT-2026-60211
Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O TRUNC, and can happen before full input validation completes “truncation-before-validatio...
CVE-2026-61371
Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via OTRUNC, and can happen before full input validation completes “truncation-before-validation...
Meeting Uncertain Threats with Feedback
Air and missile defense, naval force protection, and critical-infrastructure security require rapid allocation of scarce effectors against multiple incoming threats when neutralization is uncertain and observed only after a firing round. We formulate this defensive-allocation problem as a Markov...
AlmaLinux 8 : kernel-rt (ALSA-2026:39180)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:39180 advisory. kernel: net: bridge: use a stable FDB dst snapshot in RCU readers CVE-2026-46086 kernel: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete...
How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement
As AI agents gain prevalance, users are increasingly exposed to the risks such systems entail. Prompt injection attacks, as well as hallucination, can cause agents to leak private information to third parties. As autonomous systems, agents also present the more active danger of performing sensiti...
RHEL 9 : kernel-rt (RHSA-2026:39983)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39983 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...
CVE-2025-56362
creationtimestamp| type| source ---|---|--- 2026-07-14 23:49:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfifeijg24 2026-07-27 09:09:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmkejrkej2p...