Netatalk 安全漏洞

Netatalk is an open-source software developed by Netatalk Inc. It provides AFP file server functionality for Classic Mac OS and macOS on Unix-like operating systems. Versions 2.0.4 to 4.4.2 of Netatalk contain security vulnerabilities. These vulnerabilities stem from a confusion between UCS-2 typ...

F5 Networks BIG-IP : BIG-IP HTTP/2 vulnerability (K000159034)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4 / 21.0.0.1. It is, therefore, affected by a vulnerability as referenced in the K000159034 advisory. When an HTTP/2 profile and an iRule containing theHTTP::redirectorHTTP::respondcommand are configured ...

Authen::TOTP 安全特征问题漏洞

Authen::TOTP is a two-factor authentication OTP generation and verification tool developed by tchatzi’s developer. Prior to version 0.1.1 of Authen::TOTP, there were security vulnerabilities related to the use of the Perl built-in rand function for generating secrets. This function is predictable...

PT-2026-42421

Name of the Vulnerable Software and Affected Versions Netatalk versions 2.0.0 through 4.4.2 Description An off-by-two error in the lp write function within papd allows an adjacent network attacker to modify limited data or cause a minor service disruption by sending crafted print data...

PT-2026-42703

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.4.5 Description The MCP SSE server defaults to an empty secret via the NETWORK AI MCP SECRET environment variable, which causes the isAuthorized function to return true for all requests regardless of whether an...

PT-2026-42685

Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.23.0 Description The Fission router registers internal routes '/fission-function/' and '/fission-function//' for every function object, regardless of whether an HTTPTrigger exists. Because these routes are mounted o...

PT-2026-42461

Name of the Vulnerable Software and Affected Versions Request Tracker versions 5.0.4 through 5.0.9 Request Tracker versions 6.0.0 through 6.0.2 Description Reflected cross-site scripting XSS occurs via the Page parameter in GET requests. This allows an attacker to craft a URL that executes...

F5 Networks BIG-IP : BIG-IP SIP profile vulnerability (K000161023)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.2 / 17.5.1.6 / 21.0.0.2. It is, therefore, affected by a vulnerability as referenced in the K000161023 advisory. When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic...

CVE-2026-48110

creationtimestamp| type| source ---|---|--- 2026-05-20 22:50:48+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-4r3c-5hpg-58qr 2026-06-10 23:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnxsv4ht3726 2026-06-10...

CVE-2026-9139

creationtimestamp| type| source ---|---|--- 2026-05-20 21:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcsf6psua2z 2026-05-21 03:02:37+00:00| seen| https://infosec.exchange/users/offseq/statuses/116610329903528105 2026-06-22 02:01:38+00:00| seen|...

CVE-2026-24217

creationtimestamp| type| source ---|---|--- 2026-05-20 20:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcrn6mexd2i 2026-05-21 21:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmfd7rb3va2q...

CVE-2026-46378 vulnerabilities

Vulnerabilities for packages: vale...

curl: Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree

Hi all, We've found an issue in lib/easy.c where curleasyduphandle shallow-copies set.priority, so the original and the duplicate end up holding two independent pointer-typed variables that both reference the same heap-allocated Curldataprionode chain. Freeing the chain from one side leaves the...

CVE-2026-35008

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...

CVE-2026-39405 Frappe has Path Transversal via SCORM

Frappe Learning Management System LMS is a learning system that helps users structure their content. In versions 2.50.0 and below, a user with course editing role could upload a SCORM ZIP package to write files outside the intended directory. This issue has been resolved in version 2.50.1...

CVE-2026-35007

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in singleunit.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id GET parameter directly into an HTML attribute. Attackers can craft a maliciou...

CVE-2026-8488

creationtimestamp| type| source ---|---|--- 2026-05-20 19:11:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcmcqwycn2i 2026-05-21 12:25:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmeg2efjkj27 2026-07-23 12:19:38+00:00| seen|...

EUVD-2026-31133

InfoScale CmdServer before 7.4.2 mishandles access control...

CVE-2026-45444 WordPress Gift Cards For WooCommerce Pro plugin <= 4.2.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6...

CVE-2026-39047

creationtimestamp| type| source ---|---|--- 2026-05-20 17:59:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmcib4y7ky2w 2026-05-20 20:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmcozwcu5h2q 2026-07-13 22:00:12+00:00| seen|...