CVE-2026-30632

CVE-2026-30632 affects knowns-dev/knowns 0.11.4. The vulnerability is a directory traversal triggered by a crafted folder name value to the create_doc tool. CVSSv3.1 base score 7.5 (HIGH) with Network attack vector, Low attack complexity, Privileges Required: None, User Interaction: None; Impact:...

CVE-2026-30633

CVE-2026-30633 affects knowns-dev/knowns 0.11.4 and is a Directory traversal vuln triggered by crafted path values to the get_doc and update_doc tools. The baseline CVSSv3.1 score is 7.5 (HIGH) with NETWORK attack vector, LOW attack complexity, no privileges required, no user interaction, and imp...

CVE-2026-30633

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the getdoc and updatedoc tools...

XSSer Penetration Testing Tool 1.9

XSSer is an open source penetration testing tool that automates the process of detecting and exploiting XSS injections against different applications. It contains several options to try to bypass certain filters, and various special techniques of code injection. 12 additions, 12 modifications, 10...

CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass

The @ai-sdk/harness-opencode tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path the Codex CLI shim. This...

CVE-2026-64651

The CVE-2026-64651 entry concerns the @ai-sdk/harness-opencode tool that connects HarnessAgent to OpenCode via a sandboxed bridge. Before version 1.0.28, the tool would relay requests from any process whose command line included an allowed helper script path (host-tool-mcp.mjs), enabling untruste...

CVE-2026-16337

Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote co...

CVE-2026-63108

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command parser in parse-command.ts replaces parameter...

EUVD-2026-45950

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with rpcinfo -l, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this...

CVE-2026-16247

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

EUVD-2026-45903

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

CVE-2026-16246 Insecure permission assignment due to execution of LogPathConfig.exe during setup

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2. Starting with BRAIN2 3.09, the setup no longer executes thi...

SUSE-SU-2026:22757-1 Security update for gpg2

This update for gpg2 fixes the following issue: - CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM bsc1269279...

PT-2026-61596

A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with rpcinfo -l, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server could use this...

PT-2026-61548

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%Bizerba...

Exploit for CVE-2026-63030

wp2shell \CVE-2026-63030/CVE-2026-60137 Pre Authentication...

CVE-2026-63825 gcov: use atomic counter updates to fix concurrent access crashes

In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflatefast, the inner copy loops get transformed ...

CVE-2026-53370

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Improve validation and configuration of ACR masks Currently there are several issues on the user space ACR mask validation and configuration. - The validation for user space ACR mask attr.config2 is incomplete,...

Exploit for CVE-2026-60137

wp2shell-scanner by @bahartanirhttps://github.com/baha...

[SECURITY] Fedora 43 Update: antlr4-project-4.13.2-14.fc43

ANTLR ANother Tool for Language Recognition is a powerful parser generator for reading, processing, executing, or translating structured text or binary files. It is widely used to build languages, tools, and frameworks. From a grammar, ANTLR generates a parser that can build and walk parse trees...