CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-19383 saithink/saigroup SaiAdmin Plugin Upload Endpoint upload shell_exec unrestricted upload

A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shellexec of the file /app/saipackage/install/upload of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. Remote exploitation of the attack is possibl...

CVE-2026-19376

A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-69430

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.9.0 Description Remote Code Execution is possible through arbitrary class instantiation within the plugin-schema-registry component. Arbitrary class instantiation occurs when an application creates an instance...

libarchive security update

3.7.7-10 - Related: CVE-2026-14164 3.7.7-9 - Resolves: CVE-2026-14164...

WordPress 7.0.0 < 7.0.3

WordPress versions 7.0.0 7.0.3 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-7-0-3-release. include'compat.inc'; if description scriptid334139;...

PT-2026-69981

Name of the Vulnerable Software and Affected Versions Kitty versions prior to 0.48.2 Description In the kitty/window.py file, the @kitty-echo and @kitty-ssh DCS handlers write unauthenticated data to the child shell's stdin. The handle remote echo function accepts printable shell command...

Oracle Linux 9 : ruby:3.3 (ELSA-2026-50828)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50828 advisory. ruby 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 rubygem-mysql2 0.5.5-3 - Disable tests on the 32bit platforms ix86...

CVE-2026-3644 affecting package python3 for versions less than 3.12.9-14

CVE-2026-3644 affecting package python3 for versions less than 3.12.9-14. A patched version of the package is available...

CVE-2026-6879 affecting package python3 for versions less than 3.12.9-14

CVE-2026-6879 affecting package python3 for versions less than 3.12.9-14. A patched version of the package is available...

CVE-2026-6100 affecting package python3 for versions less than 3.12.9-14

CVE-2026-6100 affecting package python3 for versions less than 3.12.9-14. A patched version of the package is available...

npq v3.24.0

NPQ Documentation This directory contains comprehensive documentation for the NPQ Node Package Quality security auditing tool. Core Documentation optional-features.md Configuration and usage of optional security features, including recent improvements and bug fixes. age.marshall.md Detailed...

Exploit for CVE-2026-69084

CVE-2026-69084 / CVE-2026-69085 — SiYuan Arbitrary SQL Executi...

CVE-2026-19367 NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgery

A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the component readrangeconfig. The manipulation of the argument Source leads to server-side request forgery. The attack may be...

[SECURITY] [DSA 6424-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6424-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 09, 2026 https://www.debian.org/security/faq -...

CVE-2026-19366

A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insertcredsrangeconfig. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricte...

CVE-2026-69659

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor. Read actions with keyset pagination deserialize the client-supplied page:after or page:before cursor in decodevalues/2 in...

CVE-2026-15534

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

CVE-2026-19360

CVE-2026-19360 affects wongcyrus ExcelLexBot (versions up to 0.0.3) via the ExcelLexBotS3TriggerFunction in the Lambda Function Handler. The root cause is improper privilege management, with a remote-compatible attack vector described in the entry. The vulnerability impacts products that are no l...

CVE-2026-19359

A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this issue is the function SitewiseCustomFunction of the component Lambda Function Handler. Such manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version...