exploit

The Reachy Mini daemon exposes the `/api/media/sounds/upload` endpoint without authentication and file validation mechanisms. An attacker can use this endpoint

CVE-2026-17494 is a critical vulnerability affecting IBM Power Systems Firmware versions FW1120.00 and FW1110.00 through FW1110.30. The flaw resides in

The CVE-2024-49768 vulnerability resides in the partition firmware component of the IBM PowerVM Hypervisor during the network boot procedure. When

The vulnerability resides in the PowerVM hypervisor call interface, a critical component that handles privileged instructions from logical partitions (LPARs).

CVE-2026-22769 is a critical vulnerability in Dell RecoverPoint for Virtual Machines (RP4VMs) that stems from the presence of hardcoded credentials

CVE-2026-4937 is a cryptographic weakness vulnerability identified in the IBM PowerVM Hypervisor firmware. The flaw resides in the entropy selection

The vulnerability stems from unsafe handling of user-supplied file paths within the MCP (Model Context Protocol) tools `export_state` and `import_state`

The media embed renderer in PlateJS trusts serialized provider or sourceUrl metadata from document nodes. It skips the URL protocol

CVE-2026-15265 is a path traversal vulnerability residing in the plugin deployment and update mechanism of Tenable Agent versions 11.2.0, 11.1.3,

eml_parser is a Python module designed for parsing EML files—the standard format used by email clients to store individual messages.

This vulnerability resides in the `Component.__eq__` method of the Python `icalendar` library, which is used for parsing and generating iCalendar

CVE-2026-19321 is a vulnerability in IBM Power Systems host firmware affecting versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.

When Chainlit’s MCP feature is enabled via `features.mcp.enabled = true` in .chainlit/config.toml, the `/mcp` endpoint becomes active and accepts a

The vulnerability resides in the configuration parsing logic of IBM Power Systems host firmware across multiple release streams (FW1120.00, FW1110.00–FW1110.30,

IBM Power Systems Firmware is affected by a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2026-18848. The flaw resides in

IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 are affected by a critical

The identified security flaw resides within the `cmdnim` utility included in IBM AIX versions 7.2 and 7.3, as well as

Vulnerability Overview CVE-2026-55092 is a path traversal vulnerability affecting Trivy, an open-source security scanner. The vulnerability exists because Trivy does

The vulnerability resides in the `Elixir.GRPC.Server.Adapters.Cowboy.Handler’:read_full_body/3` function within the `lib/grpc/server/adapters/cowboy/handler.ex` file. This function is responsible for reading the entire body

phpMyFAQ before 4.1.5 contains an authenticated path traversal vulnerability in the PDF export functionality, specifically within the PDF image resolution

mediasoup’s built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a

AshAuthentication is an authentication framework for Elixir/Ash applications. Its OAuth2 and OpenID Connect (OIDC) family strategies contained a critical vulnerability

Technical eml_parser is a Python module developed by GOVCERT-LU that parses EML files and extracts various pieces of information from

The vulnerability resides in the partition firmware component of IBM PowerVM Hypervisor, specifically within the iSCSI SAN network boot implementation.

Intro The vulnerability exists in the `GRPC.Compressor.Gzip.decompress/1` function, located in `lib/grpc/compressor/gzip.ex` at lines 12–14. This function directly invokes `:zlib.gunzip/1` on

How CVE-2026-54338 Works JupyterHub is a multi-user server for Jupyter notebooks. Prior to version 5.5.0, the software contained a vulnerability

CVE-2026-4936 exposes a fundamental flaw in the IBM PowerVM Hypervisor Platform KeyStore (PKS) and its integrated virtual Trusted Platform Module

This vulnerability exists in the DeepSeek MCP Server because the `SessionStore` is process-global and accepts `session_id` values directly from the

CVE-2026-48853 is a critical-severity vulnerability (CVSS v4.0: 9.2) affecting the elixir-grpc library (Hex package grpc), an Elixir/BEAM implementation of the

The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes the POST /mcp endpoint without any authentication mechanism. The createMcpExpressApp function is invoked

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 are affected by a memory corruption

IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00

The vulnerability resides in the `/mcp` endpoint of Chainlit when the MCP (Model Context Protocol) feature is enabled via `features.mcp.enabled

Vulnerability CVE-2026-17429 is a critical vulnerability in IBM Power Systems Firmware that compromises the security boundary between the Baseboard Management

The group‑rights endpoint in phpMyFAQ (GroupController::updatePermissions, route /admin/group/update/permissions) lacks a critical authorization check that was correctly added to its user‑rights

CVE-2026-15961 is a medium-severity vulnerability identified in the IBM PowerVM Hypervisor firmware. The flaw resides in the improper control of

The genieacs-mcp package, version 0.3.1 at commit 4d7d3c74740efb7f3833aadc8a8e9177650eb462, exposes a local Streamable HTTP MCP endpoint that listens on loopback by

In the HTTP-to-gRPC transcoding layer of the `grpc` Hex package, a critical authorization bypass vulnerability exists due to improper parameter

A vulnerability in phpMyFAQ versions 4.1.0 through 4.1.4 allows unauthenticated access to inactive (draft or review-only) FAQ content through public

How CVE-2026-55620 Works eml_parser is a Python module designed to parse EML files and extract various information from emails. Prior

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 contain a critical improper authentication vulnerability that allows unauthenticated remote attackers

CVE-2026-17145 is a critical vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS (Virtual I/O

CVE-2026-18828 is a vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1. The

CVE-2026-17141 is a critical buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM Virtual

CVE-2026-17152 is a critical vulnerability identified in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM Virtual I/O

CVE-2026-17424 is a path traversal vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM Virtual I/O

IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due

CVE-2026-18835 is a critical OS command injection vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM

CVE-2026-18716 is a security flaw identified in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version

CVE-2026-17195 is a memory corruption vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM Virtual I/O

CVE-2026-17436 is a critical heap-based buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM

Technical Overview CVE-2026-18670 is a critical vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM Virtual

CVE-2026-17423 is a critical vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1.

CVE-2026-17136 is a critical format string vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 are affected by a critical heap-based buffer overflow vulnerability identified as

CVE-2026-17124 details a memory corruption vulnerability present in IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS

IBM AIX versions 7.2 and 7.3, alongside IBM PowerVM Virtual I/O Server (VIOS) version 4.1, are affected by a stack-based

IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 are susceptible to a stack-based buffer overflow vulnerability identified as CVE-2026-17138.

CVE-2026-18822 is a locally exploitable denial-of-service vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as the PowerVM Virtual

CVE-2026-17422 is a critical vulnerability identified in IBM AIX versions 7.2 and 7.3, as well as the IBM PowerVM VIOS

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface

How GHSA-3gjw-f78c-vvpw Works The vulnerability resides in the way `tokio-postgres` handles `DataRow` messages from a PostgreSQL server. During query execution,

Cloudreve is a self-hosted file management and sharing system. A vulnerability exists in its remote download functionality where the application

CVE-2026-21962 represents a critical vulnerability within the Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in, which are core

IBM Power Systems 固件（版本 FW1120.00、FW1110.00 至 FW1110.30、FW1060.00 至 FW1060.80 及 FW950.00 至 FW950.H2）中的 ASMI（高级系统管理接口）Web 界面存在一个漏洞。 该漏洞允许未经身份验证的攻击者通过网络向 FSP（Flexible Service Processor）发送特制的恶意请求。由于 ASMI

The CMS page cache key ignores the request headers that plugins declare via get_vary_cache_on(). The header is added to the

netfoil is a Go‑based DNS‑over‑HTTPS (DoH) proxy that resolves DNS queries over HTTPS to enhance privacy. To support advanced features

CVE-2026-16924 is a remotely exploitable denial of service vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying

CVE-2025-36255 details a critical privilege escalation flaw affecting IBM System Storage DS8A00 (versions 10.1.3.0 through 10.11.35.0) and IBM DS8900F (versions

The vulnerability exists in the HTTP/1.x chunked encoding parser of the `vibeio-http` crate, a high-performance HTTP server primitive library for

CVE-2026-16927 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1.

A critical vulnerability has been identified in the Rust `postgres-protocol` crate, which is used by popular PostgreSQL clients like `tokio-postgres`

CVE-2026-18102 details a memory corruption flaw within the IBM i operating system (versions 7.6, 7.5, 7.4, and 7.3). The root

The Sakai Conversations tool is vulnerable to stored cross-site scripting due to insufficient input sanitization and unsafe rendering practices. The

CVE-2026-16991 is a local privilege escalation vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS

IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, are affected by a critical OS command injection vulnerability

CVE-2026-16922 is a vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1. The

The `move_plugin` admin endpoint in django CMS prior to version 5.0.8 contains a vulnerability that allows an authenticated staff user

CVE-2026-17063 is a vulnerability affecting the interface between the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) and the

The `postgres-protocol` crate, a popular Rust library for implementing PostgreSQL wire protocol clients, contains a vulnerability in its handling of

Cloudreve’s file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow-up operations. When that hint

The vulnerability resides in the IBM i operating system’s handling of user‑supplied input within specific network‑facing services. A remote authenticated

How CVE-2025-36398 Works CVE-2025-36398 is a vulnerability affecting IBM System Storage DS8A00 and DS8900F storage systems. The flaw resides in

Prior to commit d67f4185, the Gorilla WebSocket library (github.com/gorilla/websocket) used the `math/rand` package to generate mask keys for WebSocket frames.

CVE-2026-16925 is a vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1. The

In Splunk Connect for Kafka versions prior to 2.2.7, an unauthenticated attacker with network access to the Kafka Connect REST

CVE-2026-16989 details a local privilege escalation vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS

CVE-2026-21962 is a critical vulnerability affecting the Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in components of Oracle

CVE-2026-76398 affects Splunk AI Toolkit versions prior to 6.0.1, introducing a critical flaw in the Representational State Transfer (REST) API

CVE-2025-36254 details a critical security flaw in IBM’s enterprise storage management interface. The vulnerability resides in the DSCLI (DS Command-Line

The vulnerability resides in the Sakai REST API endpoint DELETE /api/users/{userId}/profile/image. The `ProfileController.removeProfileImage()` method relies on `checkSakaiSession()` to validate that

CVE-2026-70912 is a security vulnerability identified in the Oracle Hyperion Financial Management (HFM) product, specifically within its Security component. The

CVE-2026-70768 is a vulnerability identified in the Oracle Hyperion Financial Reporting product, specifically within its Server component. The affected version

CVE-2026-70774 resides in the Internal Operations component of Oracle Warehouse Management, which is a sub-module within the Oracle E-Business Suite.

This vulnerability resides in the Security component of Oracle Hyperion Financial Management (HFM), specifically affecting version 11.2.25.0.000. The core issue

CVE-2026-70917 resides in the Oracle Hyperion Financial Management (HFM) product, specifically within its Security component. The flaw affects version 11.2.25.0.000

IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a critical vulnerability that allows a remote attacker