Skip to content
skopnix
Section C · The archive
Every edition · newest first

The archive.

1,107 dispatchespage 2 / 19№ 1,047 – 988

  1. Thu 08 Oct 2026

    13 dispatches
    GHSA-48qf-xh34-q73r: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersVULN
  2. GHSA-c3jg-qh8m-j3h2: CairoSVG: Quadratic-time DoS parsing a crafted SVGVULN
  3. Low-cost Android phones ship with residential proxy malwareSUPL
  4. GHSA-77xj-x4rm-935c: datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outsideVULN
  5. GHSA-8r5x-fm3f-whwj: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)VULN
  6. GHSA-p8wg-vrv2-v86f: Handlebars: JavaScript Injection via Own Property Check BypassVULN
  7. GHSA-mx22-3794-2vpv: Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicVULN
  8. GHSA-6gcq-wc29-5xf2: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflowVULN
  9. GHSA-8f34-f56x-9xph: msgpack5: Truncated map32 headers throw an unexpected errorVULN
  10. GHSA-5x5g-h9x8-2fh9: msgpack5: Many buffered values can exhaust the streaming decoder stackVULN
  11. Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firmsAPT
  12. UAT-11985: AI-assisted event lures delivering real-time Google AitM phishingAPT
  13. Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flawsVULN

  14. Wed 07 Oct 2026

    19 dispatches
    GHSA-w794-rj3p-xv45: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationVULN
  15. GHSA-4hmc-cfm3-w43c: Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersVULN
  16. GHSA-p96c-xwx8-3cqj: Payload has a tenant authorization bypass in Multi-Tenant PluginVULN
  17. GHSA-pj5h-5q6c-3pfx: Payload external upload trust validation issueVULN
  18. GHSA-7vg8-29qx-jgj8: Payload: Client uploads could overwrite S3 objectsVULN
  19. GHSA-r488-j9vj-wx3q: Payload Form Builder has an RCE issueVULN
  20. GHSA-f7hx-52q9-hcrf: Payload: Unauthorized update to collection documentsVULN
  21. SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 AppliancesEXPL
  22. GHSA-jj3q-cwqj-842r: ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heapVULN
  23. GHSA-4f6c-2vvp-gw82: Langflow: IP Spoofing Bypass via X-Forwarded-For Allowing Remote Configuration WriteVULN
  24. GHSA-pq96-jpmf-w254: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()VULN
  25. GHSA-6xp5-7rcx-xfgx: Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First LoginEXPL
  26. GHSA-rqcc-94gv-wjm9: Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)EXPL
  27. GHSA-g6j7-pffp-8whg: PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationEXPL
  28. CVE-2026-105192: LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQVULN
  29. Wikimedia Finds Unauthorized OpenAI Agent Activity on WikipediaBRCH
  30. 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealerMALW
  31. NCSC-2026-0403 [1.00] [M/H] Kwetsbaarheden verholpen in SonicWall SMA1000 ApplianceVULN
  32. Ransomware: termite → AonRANS

  33. Tue 06 Oct 2026

    10 dispatches
    Ninja Forms plugin flaw exploited to hack WordPress sitesEXPL
  34. GHSA-6r3q-mjv7-xr8m: Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingVULN
  35. GHSA-fx49-4h83-wjv9: Payload didn't enforce field-level password update restrictionsVULN
  36. GHSA-vc4h-q48j-5hcx: Payload: Field access control bypass on auth collectionsVULN
  37. GHSA-qf28-8hc6-vwrp: Payload: Prototype pollution in Payload Import Export pluginVULN
  38. GHSA-v49j-62m6-pgrr: Payload: SQL Injection in SQLite and PostgresVULN
  39. GHSA-w5f4-fx9m-m4q7: MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLVULN
  40. "Japanese police have captured a Russian national believed to be a key member of the “Qilin” international hacker group and extradited him to Germany, investigative sources saidAPT
  41. GHSA-pqg4-j6r4-53mv: shell-quote: quote() command injection via a line terminator in a token after a { comment } tokenVULN
  42. GHSA-8qpj-27x8-pwpq: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilegeEXPL

  43. Mon 05 Oct 2026

    18 dispatches
    GHSA-v5rq-49vh-5v5c: simple-git: VISUAL editor environment variable is omitted from unsafe editor detectionVULN
  44. GHSA-x6jw-m9v5-85vh: simple-git unsafe-operation guard does not block trailer command configurationVULN
  45. GHSA-jqcg-44mw-7w3h: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetVULN
  46. GHSA-w2vw-w76x-qr89: Nx: OS command injection via git revisions and remote refsVULN
  47. GHSA-w3vv-58gj-gw77: Nx daemon and plugin worker sockets are accessible to other local usersVULN
  48. GHSA-27vj-qcqg-25rc: fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code ExecutionVULN
  49. GHSA-rvm3-566m-v7fv: Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathVULN
  50. GHSA-g2v6-rqmx-r4w6: @vue/server-renderer: XSS via missing CR in attribute-name blacklistVULN
  51. GHSA-5gmw-xhrv-c9v3: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code ExecutionVULN
  52. GHSA-85c8-ppgw-ccpr: Tinypool: Prototype Pollution Gadget to RCE in run() optionsVULN
  53. GHSA-88hf-g992-jg85: vm2: Sandbox Escape (NodeVM)VULN
  54. GHSA-gjq8-xm47-88rc: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the hostVULN
  55. GHSA-3vgf-8m4q-q4qr: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fixVULN
  56. GHSA-x965-fc75-jpqh: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycleVULN
  57. GHSA-j3hm-6rg5-mchv: vm2: NodeVM require.external without an explicit require.root grants unrestricted host filesystem accessVULN
  58. GHSA-fcqc-726x-5wfc: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer poolVULN
  59. GHSA-wjwh-qqvp-g4p4: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypassVULN
  60. GHSA-cf6m-vc3m-7cgm: Langflow: Unauthenticated Flow Execution via Webhook Authentication BypassVULN