PT-2026-55579

Name of the Vulnerable Software and Affected Versions RT-Thread versions prior to 5.0.3 Description A stack-based buffer overflow exists in the recvmsg function within the bsp/loongson/ls1cdev/libraries/ls1c can.h library of the ls1c CAN Handler component. This issue requires local access to be...

PT-2026-55595

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description The software fails to scope the lookup of tracked-time entries to the specific issue provided in the request URL when searching by time ID. This flaw allows an attacker to attempt the deletion of time...

Notepad++ 8.9.6.2 < 8.9.6.4 TOCTOU Race Condition (CVE-2026-52885)

The version of Notepad++ installed on the remote host is 8.9.6.2 or 8.9.6.3. It is, therefore, affected by a TOCTOU race condition vulnerability: - A time-of-check time-of-use TOCTOU race condition exists in the HMAC verification of shortcuts.xml. The HMAC check validates the on-disk file at...

pwnlift Symlink File Write

Symlink following and TOCTOU issues in the pwnlift upload handler allow arbitrary file write as root...

CVE-2026-8482

creationtimestamp| type| source ---|---|--- 2026-07-02 22:23:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp33iarsq22 2026-07-03 03:25:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpplws66tk2q...

CVE-2026-11896

creationtimestamp| type| source ---|---|--- 2026-07-02 22:20:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp2vp73e32d...

CVE-2026-59099

creationtimestamp| type| source ---|---|--- 2026-07-02 22:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpozsoeoil2t 2026-07-03 00:08:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppaxex7xh24 2026-07-03 15:09:49+00:00| seen|...

MAL-2026-6733 Malicious code in epic-build-scripts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14d466b50466bb93e6e9130d18e67b680c7255beecafe16043dc5ee51bfec886 On import epicbuildscripts, the package's top-level init spawns a background thread that POSTs a JSON payload containing socket.gethostname, the...

Malicious code in unreal-mladapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126bf3493d123333b47fba2ed68e30c085c8266dfb4d16923a81e9ee094f4780 The package name unreal-mladapter mimics Epic Games' internal UnrealMLAdapter plugin and is published at version 99999.0.0 — the canonical high-versi...

CVE-2026-38968

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...

AZL-92103 CVE-2026-38968 affecting package ntopng 5.2.1-6

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...

CVE-2026-55950

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

CVE-2026-55950 DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

CVE-2026-55950 DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

CVE-2026-55950

Time-of-check Time-of-use TOCTOU race condition vulnerability in Erlang/OTP ssl dtlspacketdemux module allows an unauthenticated remote attacker to crash all active DTLS sessions on a listener. A DTLS server listener uses a single shared dtlspacketdemux genserver process to route incoming UDP...

js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...

CVE-2026-54262

creationtimestamp| type| source ---|---|--- 2026-07-02 14:28:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaj35qfl27 2026-07-03 13:26:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnk6jp5n2c...

CVE-2026-54704

creationtimestamp| type| source ---|---|--- 2026-07-02 14:26:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoagu42pq2i 2026-07-03 09:28:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqa7twgj52w 2026-07-29 19:31:52+00:00| seen|...

CVE-2026-13251

creationtimestamp| type| source ---|---|--- 2026-07-02 14:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpo7rpkclv27 2026-07-02 22:22:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp2yymfoc2o 2026-07-02 22:22:22+00:00| seen|...

EUVD-2026-41274

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprploadmorerevs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $POST'notinstring' and passed through sanitizetextfield — which strips HTML and...