CVE-2025-41759

An administrator may attempt to block all networks by specifying "\" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all...

CVE-2026-24713

Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue...

Windows Graphics Component Denial of Service Vulnerability

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries

Cybersecurity researchers have disclosed nine cross-tenant vulnerabilities in Google Looker Studio that could have permitted attackers to run arbitrary SQL queries on victims' databases and exfiltrate sensitive data within organizations' Google Cloud environments. The shortcomings have been...

CVE-2026-2339 RCE in TUBITAK BILGEM's Liderahenk

Missing Authentication for Critical Function vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows Remote Code Inclusion, Privilege Abuse, Command Injection. This issue affects Liderahenk: before 3.5.1...

The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction

You can't control when the next critical vulnerability drops. You can control how much of your environment is exposed when it does. The problem is that most teams have more internet-facing exposure than they realise. Intruder's Head of Security digs into why this happens and how teams can manage ...

WordPress Deston theme <= 1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Deston versions = 1.0...

Actual Sync Server has an Authenticated Path Traversal

Description Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments ../ can escape the intended directory and write files outsid...

Fortinet FortiSIEM 跨站脚本漏洞

Fortinet FortiSIEM is a security information and event management system developed by the American company Fortinet. This system includes features such as asset discovery, workflow automation, and unified management. Versions of Fortinet FortiSIEM ranging from 7.3.0 to 7.3.4 contain a cross-site...

PT-2026-24296

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally...

PT-2026-36149

Name of the Vulnerable Software and Affected Versions GnuTLS affected versions not specified Description A flaw in DTLS handshake parsing allows malformed fragments with zero length and non-zero offset to cause an integer underflow during reassembly. This leads to an out-of-bounds read, which is...

PT-2026-24483

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description Flowise, a drag & drop user interface for building customized large language model flows, contains a Server-Side Request Forgery SSRF issue. The application exposes an HTTP Node within AgentFlow and...

Microsoft GitHub Repo: Zero Shot scFoundation 安全漏洞

Microsoft GitHub Repo: Zero Shot scFoundation is a biological information research code base owned by Microsoft Corporation. There are security vulnerabilities present in Microsoft GitHub Repo: Zero Shot scFoundation. Attackers can exploit these vulnerabilities to execute code remotely...

MCP Atlassian 安全漏洞

MCP Atlassian is an MCP server developed by Hyeonsoo Lee, which connects AI assistants with project management tools. There were security vulnerabilities in versions of MCP Atlassian prior to 0.17.0. These vulnerabilities stemmed from the confluencedownloadattachment tool not enforcing directory...

Microsoft ASP.NET Core 安全漏洞

Microsoft ASP.NET Core is a cross-platform open-source framework developed by Microsoft. This framework is used to build cloud-based applications such as web applications, IoT applications, and mobile backends. There are security vulnerabilities in Microsoft ASP.NET Core. Attackers have exploited...

Microsoft .NET 缓冲区错误漏洞

Microsoft .NET is a software framework developed by Microsoft Corporation in the United States. It focuses on agile software development, rapid application development, platform independence, and network transparency. There is a buffer error vulnerability in Microsoft .NET. Attackers can exploit...

WordPress 6.0 < 6.9.2

WordPress versions 6.0 6.9.2 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-6-9-2-release. include'compat.inc'; if description scriptid301728;...

PT-2026-24463

Name of the Vulnerable Software and Affected Versions file-type versions prior to 21.3.1 Description A denial of service issue exists in the ASF WMV/WMA file type detection parser within file-type. When processing a specially crafted input where an ASF sub-header has a size field of zero, the...

The vulnerability of the damon_lru_sort_apply_parameters() function in the mm/damon/lru_sort.c file, a memory management subsystem of the Linux operating system, allows a hacker to trigger a system failure.

The vulnerability of the damonlrusortapplyparameters function in the mm/damon/lrusort.c file, a memory management subsystem of the Linux operating system, is related to insufficient validation of input data when dividing by zero. Exploiting this vulnerability could allow an attacker to cause a...

CVE-2026-30920 OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installationid values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...