PT-2026-6323

Name of the Vulnerable Software and Affected Versions @isaacs/brace-expansion versions prior to 5.0.1 Description @isaacs/brace-expansion, a hybrid CJS/ESM TypeScript fork of brace-expansion, is subject to a denial of service DoS issue. This occurs due to unbounded brace range expansion when...

CVE-2025-61641

CVE-2025-61641 affects Wikimedia Foundation MediaWiki, tied to program files includes/api/ApiQueryAllPages.Php and impacts MediaWiki versions before 1.39.14, 1.43.4, 1.44.1. Debians and OSV entries describe multiple issues (e.g., XSS, information disclosure, missing rate limiting, denial of servi...

CVE-2025-12679

A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption PBE key in plaintext in the system audit log file. The vulnerability could allow a remote authenticated attacker with access to the audit logs to access the pbe key. Note: The vulnerability is only triggered duri...

CVE-2025-6597

CVE-2025-6597 affects Wikimedia Foundation MediaWiki, specifically the authentication management component in includes/auth/AuthManager.Php. The vulnerability is listed for MediaWiki versions before 1.39.13, 1.42.7, 1.43.2, and 1.44.0. Red Hat notes a weakness in how authentication is handled; De...

CVE-2026-0631

The CVE-2026-0631 issue affects TP-Link Archer BE230 v1.2 (vpn modules) with firmware older than 1.2.4 Build 20251218 rel.70420. It is described as an OS Command Injection that allows an adjacent authenticated attacker to execute arbitrary code, potentially gaining full administrative control and...

CVE-2026-25201

An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue affects MagicINFO 9 Server: less than 21.1090.1...

PT-2026-5691

A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise...

PT-2026-51155

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 1.0.1 Description Unsafe pickle deserialization allows unauthenticated attackers to create arbitrary zero-byte files. This is achieved through the instantiation of the logging.FileHandler class. By crafting malicio...

FnOS-exploit

FnOS Path Traversal Vulnerability Exploitation Random File Re...

Pironman Dashboard 安全漏洞

Pironman Dashboard is a console interface open-sourced by SunFounder. Versions of Pironman Dashboard prior to 1.3.13 have security vulnerabilities; these vulnerabilities stem from path traversal in the log file API endpoints, which could lead to arbitrary file reading and deletion...

CLEANSTART-2026-HV28992 Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3

Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3. See references for individual vulnerability details...

CVE-2025-7016

Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse.This issue affects QR Menu: before s1.05.12...

CVE-2026-25210

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation...

WordPress profile-builder plugin < 3.11.9 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by John Castro in WordPress Plugin Profile Builder versions 3.11.9...

CVE-2025-57795

Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution...

CVE-2025-7016

Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects QR Menu: before s1.05.12...

CVE-2026-22764

Dell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2026-22764

Dell OpenManage Network Integration, versions prior to 3.9, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

Bdtask Bhojon All-In-One Restaurant Management System has security vulnerabilities.

Bdtask Bhojon All-In-One Restaurant Management System is a restaurant management system developed by the Bangladeshi company Bdtask. Versions of the Bdtask Bhojon All-In-One Restaurant Management System prior to version 20260116 contained security vulnerabilities. These vulnerabilities were cause...

AZL-75707 CVE-2025-61728 affecting package golang for versions less than 1.24.12-1

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive...