CVE-2026-51119

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...

The vulnerability of the Python programming language’s HTTP client module allows attackers to inject arbitrary HTTP headers.

The vulnerability of the Python programming language’s HTTP client module is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

PT-2026-57297

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq management HTTP API accepts oversized valid JSON bodies on with decode and direct request paths because read complete body checks the accumulated size before the final chunk but not the final...

ROS-20260710-73-0033

The vulnerability of the Go programming language is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-57368

Name of the Vulnerable Software and Affected Versions ps facetedsearch versions 3.0.0 through 4.0.3 Description An unauthenticated PHP Object Injection flaw exists in the ps facetedsearch module. The module rebuilds search filters from the request URL, where values for slider filters, specificall...

CVE-2026-51119

Invixium IXM WEB 2.3.85.25 is affected. The issue allows privilege escalation via the /SystemUsers/CreateAppUser component, as described in CVE-2026-51119, with CVSS 3.1 base score 9.1 (CRITICAL). No specific root-cause, vulnerable version ranges, exploit details, or fixes are provided beyond thi...

CVE-2025-70796

An unauthenticated path traversal in the web management interface of WTI (Wireless Technology, Inc.), version 3.5.0.r 2024/05/24 00:00:00, allows crafted HTTP requests with traversal sequences to access files outside the web root, potentially disclosing sensitive system files and configuration da...

Linux Distros Unpatched Vulnerability : CVE-2026-58501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transiti...

PT-2026-57232

Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.33.0 Description The software fails to verify if an element is a legitimate button or if the associated cookie belongs to a handled service when calling the tarteaucitron.cookie.purge function on elements...

MAL-2026-10104 Malicious code in px8my (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7da37dfbaa4b355a75e38c244bc5614299ecc5a1f3bc1dd072fdc7c4f2dc13b9 px8my's main entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL https://mfmz.gzhrjq.cn/H.html?c=0gjr...

MAL-2026-10107 Malicious code in security-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2450dc325921e41fd15c24339c29dc86bef36424dd6f8447c07cffd219f3955a package.json declares the package's own name as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/security-node, a...

Malicious code in rallycoding (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 789e913282e371428b19e015e619b6a3dd6c8d9938ad0e08a1f37d0248d28e0a package.json declares 'rallycoding' as its own dependency, resolved from an unauthenticated plain-HTTP URL http://pack.nppacks.com/npm/rallycoding...

CVE-2026-57054

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. If an MX Series device is...

CVE-2026-57021

An Out-of-bounds Write vulnerability in the http-gatekeeper http-gk of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an SRX Series device is configured for remote-access VPN with pre-logon compliance check, a...

CVE-2026-55689

OpenFGA is an authorization/permission engine built for developers. Prior to 1.18.0, OpenFGA's OIDC authenticator skipped JWT audience validation when authn.method was set to oidc, authn.oidc.issuer was configured, and authn.oidc.audience was not set, allowing a token minted for an unrelated...

CVE-2026-53961

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish...

CVE-2026-15271

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185RT10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege...

CVE-2026-53962 Discourse: Insufficient SVG sanitization logic

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, insufficient SVG sanitization in upload and user avatar handling could lead to cross-site scripting when a user visited specific URLs that are not normally part of community browsing. This issue ...

CVE-2026-53961

CVE-2026-53961 concerns Discourse, an open-source discussion platform. Prior to the fixed versions, the AWS SES bounce webhook at POST /webhooks/aws did not bind SNS-signed messages to trusted TopicArn values, enabling any AWS account holder to publish forged Bounce notifications that revoke a ta...

CVE-2026-53961 Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish...