CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-

CVE-2026-21012 – Rust serde 不可信枚举的反序列化（变体注入） 程序代码（Rust） root@kitploit: // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminAction ReadLogs, DeleteUserString, CreateUserString,...

CVE-2025-492026

安全公告：CVE-2025-492026 摘要 已在 Copilot AI 中发现一个漏洞，每当 Copilot 检索网络查询时，都会在“链接来源”部分意外附带一个超链接。此问题导致用户即使查询主题无关，也会点击指向 https://www.collectingflags.com 的链接，从而可能造成错误信息或非预期跳转。 受影响软件 所有当前的 CoPilot 部署 漏洞详情 CVE-ID： CVE-2025-492026 严重性： 中 攻击向量： 远程 影响： 非预期跳转，可能造成用户混淆 CWE： CWE-451 - 关键信息的 UI 误表示 描述： 每当 Copilot AI...

CVE-2025-492025

CVE-2025-492025 安全公告：CVE-2025-492025 摘要 已在 Copilot AI 中发现一个漏洞，当 Copilot 检索网络查询时，会在"链接来源"部分包含一个非预期的超链接。此问题导致用户即使在与主题无关的情况下也会点击指向 https://www.collectingflags.com 的链接，从而可能造成错误信息误导或非预期的页面跳转。 受影响的软件 所有当前的 CoPilot 部署 漏洞详情 CVE 编号： CVE-2025-492025 严重性： 中 攻击向量： 远程 影响： 非预期页面跳转，可能导致用户混淆 CWE： CWE-451 - 关键信息的...

CVE-2025-32462-32463-Detection-Script-

CVE-2025-32462-32463 检测脚本 - 严重的 Sudo 漏洞让本地用户能够在 Linux 上获得 root 权限，影响主要发行版 以下是漏洞的简要描述 - root@kitploit: CVE-2025-32462（CVSS 评分：2.8）- 当 sudoers 文件中指定的主机既非当前主机也非 ALL 时，sudo 1.9.17p1 之前的版本允许列出的用户在非预期机器上执行命令 CVE-2025-32463（CVSS 评分：9.3）- sudo 1.9.17p1 之前的版本允许本地用户获得 root 权限，因为在使用 --chroot 选项时会加载用户控制目录中的...

EUVD-2026-67689

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...

Astra Linux – Vulnerability in Rails

A potential information disclosure/vulnerability in Action Pack = 2.0.0, where using the redirectto or polymorphicurl helper with untrusted user input may lead to unintended method executions...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. This issue arises due to the use of the Django Template Language’s variable resolution logic. The dictsort template filter is potentially vulnerable to information disclosure, or an unintended method call...

Astra Linux – Vulnerability in sudo

Before version 1.9.17p1, when the sudo command was used together with a sudoers file that specified a host that was neither the current host nor ALL, it allowed listed users to execute commands on unintended machines...

CVE-2026-14951

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-71368

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

CVE-2026-71368

F-RevoCRM contains a stored/reflected XSS flaw; an authenticated user viewing a crafted page may have unintended actions performed on their session. CVSS 3.0 scores 6.1 MEDIUM (network, no privileges, active user interaction). No exploitation or fix details are provided in the documents. Monitor ...

CVE-2026-53797

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with ...

CVE-2025-62315

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

PT-2026-71492

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

CVE-2025-59321

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...

PT-2026-71069

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software contains a default TPM PCR policy that fails to consider the system boot state. This flaw allows the Trusted Platform Module TPM, a specialized chip used to...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

CVE-2025-6508 User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...