Important: ecs-init

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

RHEL 10 : golang-github-openprinting-ipp-usb (RHSA-2026:7992)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:7992 advisory. HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protoco...

PT-2026-32888

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser...

Medium: oci-add-hooks

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

Important: nerdctl

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

The vulnerability of D-Link DI-8003 router microprogramming software, related to buffer overflow in the stack, allows a hacker to trigger a service failure.

The vulnerability of D-Link DI-8003 router microprogramming software is related to buffer overflow in the stack when processing the name parameter. Exploiting this vulnerability allows an attacker to cause a service failure by sending a specially crafted GET request to the /urlgroup.asp endpoint...

PT-2026-32930

Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user to store a malicious javascript: URL inside an attachment node in page content. When another user vie...

Important: docker

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2026-104 (ALASDOCKER-2026-104)

"The version of containerd installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-104 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On...

Important: containerd

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

PT-2026-32890

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Cross-Site Scripting XSS vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or contr...

Totolink A3002MU formWlanSetup file wan-url parameter stack buffer overflow vulnerability

Totolink A3002MU is a wireless router product that provides network connectivity and wireless access. A stack buffer overflow vulnerability exists in the Totolink A3002MU. The vulnerability stems from a failure to properly handle the wan-url parameter in the HTTP request handling component, which...

Medium: oci-add-hooks

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

Amazon Linux 2 : containerd, --advisory ALAS2ECS-2026-102 (ALASECS-2026-102)

"The version of containerd installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-102 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Un...

SUSE SLES15 / openSUSE 15 Security Update : python312 (SUSE-SU-2026:1292-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1292-1 advisory. - CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type AREGTYPE are combined can lead to...

Amazon Linux 2 : docker, --advisory ALAS2DOCKER-2026-108 (ALASDOCKER-2026-108)

"The version of docker installed on the remote host is prior to 25.0.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-108 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On...

CVE-2026-6224

creationtimestamp| type| source ---|---|--- 2026-04-13 23:21:32+00:00| published-proof-of-concept| Telegram/DNd18EV1mvoOjDBqQat4zOgBzw-F-OvAJ7pAjcWk8VU 2026-04-14 01:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjgbpwk74k23...

CVE-2026-32272

creationtimestamp| type| source ---|---|--- 2026-04-13 23:21:07+00:00| seen| Telegram/sslKRMt7XnAICw7zsZDqotnt2tiVrXD0JXK6a6QUxCGOW4 2026-04-14 02:08:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjgcdnm6ug2o...

CVE-2026-4786

creationtimestamp| type| source ---|---|--- 2026-04-13 22:36:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjfwhyhvn62e 2026-04-13 23:21:32+00:00| published-proof-of-concept| Telegram/DNd18EV1mvoOjDBqQat4zOgBzw-F-OvAJ7pAjcWk8VU 2026-04-14 01:20:57+00:00| seen|...

ALPINE-CVE-2026-4786

Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open" API could have commands injected into the underlying shell. See CVE-2026-4519 for details...