Skip to content
skopnix
Section C · The archive
Every edition · newest first

The archive.

1,109 dispatchespage 5 / 19№ 869 – 810

  1. Thu 24 Sep 2026

    31 dispatches
    GHSA-3cj3-hqcr-g934: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (/browser endpoint)VULN
  2. GHSA-36h5-qg4p-q2qf: zbateson/mail-mime-parser has CRLF header injection via attachment filenameVULN
  3. GHSA-f6v3-2qmr-vfjx: zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMEVULN
  4. GHSA-jmg2-rcxh-w8q3: @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build MetadataVULN
  5. GHSA-4hq8-gpf5-8p68: Podman: Malformed Image can trick podman run into leaking host environment variables into the containerVULN
  6. GHSA-mwwr-p57h-56pf: @bytebase/dbhub's read-only mode does not prevent database writesVULN
  7. GHSA-fm8p-53ww-hf6w: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionVULN
  8. GHSA-cjx3-73hr-rpw7: http4s-scala-xml has an XML External Entity (XXE) processing issueVULN
  9. GHSA-36f9-7rg5-cpf8: @bsv/wallet-toolbox / -client / -mobile don't verify storage-supplied recipient output scripts againstVULN
  10. GHSA-rw77-vq4g-x3hp: phpMyFAQ has SQL Injection in StopWords::add() — Unescaped Stop Word InsertionVULN
  11. GHSA-8gpw-xvpf-hvx5: phpMyFAQ's two-factor authentication login bypasses the password factorVULN
  12. GHSA-pgwp-vc7q-cvj3: phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionVULN
  13. GHSA-g28h-2cmm-rj9x: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputsVULN
  14. GHSA-w3rp-4cm2-4wgc: ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypassVULN
  15. GHSA-g5f9-3xfg-p9mf: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLMVULN
  16. CVE-2026-96749: An integer overflow in the BSON document encoding component of the MongoDB PythonVULN
  17. CVE-2026-96748: PyMongo's connection string parsing decodes percent-encoded characters in the hostVULN
  18. GHSA-396x-xmvh-p563: Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APIVULN
  19. GHSA-9993-rfwp-rhwf: ZITADEL: MFA bypass via session reuse in Login V2VULN
  20. GHSA-fgmf-7rf8-m6vf: ZITADEL: Actions V1 sandbox escape: host file read via require()VULN
  21. GHSA-p9h3-gvpq-5539: Snipe-IT: Stored XSS via Custom Field name in asset-list column headersVULN
  22. GHSA-6rf4-v2fh-m6p4: SunEditor: Critical XSS vulnerability - sanitizer bypassVULN
  23. Kyiv internet providers report major outages after Russian attacks damage data centersAPT
  24. Hackers now exploit critical Roundcube flaw in code injection attacksEXPL
  25. One Week, Five Flaws, Same Weak Point: The Management LayerRANS
  26. When Business Email Compromise Starts Rewriting RealityKEV
  27. OpenAI agent breached Australian government health website, Albanese saysBRCH
  28. CISA: Ransomware gangs now exploiting critical TeamCity flawEXPL
  29. NCSC-2026-0393 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign ClassicVULN
  30. CLOSEDQUORUM, the malware that asks four AI models what to do nextMALW
  31. Your security program knows about the firewall, but does it know about the elevator?APT

  32. Wed 23 Sep 2026

    22 dispatches
    GHSA-9643-4qgh-g8mx: elysia has Inefficient Algorithmic Complexity and Interpretation ConflictVULN
  33. GHSA-wmw4-mw6x-6vfm: ReactPress has SQL injection via dynamic column names in TypeORM query buildersVULN
  34. GHSA-gvf2-2rh5-mpgf: OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widgetVULN
  35. GHSA-9wh6-9hq7-9688: Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSVULN
  36. GHSA-7c7c-373r-gfjj: Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryVULN
  37. GHSA-26r5-4mm2-px5c: Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplaceVULN
  38. GHSA-9rg8-2wvr-fgjh: Formie: Missing authorization on sent notification resend modal exposes submission PIIVULN
  39. GHSA-w4cm-gvhj-cgw6: Jawn: Quadratic parsing effort in AsyncParserVULN
  40. GHSA-cc4v-rvgp-2pf3: Jawn: Uncontrolled nesting depth in JSON parserVULN
  41. Ransomware: emperador → OnTracBRCH
  42. GHSA-jjq7-m736-w977: OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlayVULN
  43. Ransomware: clop → ALDOGROUP.COM(ALDOSHOES.COM)BRCH
  44. Ransomware: clop → BRINKS-CO.NZBRCH
  45. GHSA-5f42-97gr-vfhq: Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticatedVULN
  46. GHSA-rr49-f9g6-c9r5: plone.app.portlets Vulnerable to Remote Code Execution via TALES InjectionVULN
  47. WordPress patched an unauth path traversal yesterday: https:// github.com/WordPress/wordpress -develop/security/advisories/GHSA-7hp8-65ch-5whp httpsEXPL
  48. OAuth Token Theft Through Microsoft's Front DoorRSCH
  49. Arista patches actively exploited VeloCloud Orchestrator zero-dayEXPL
  50. NCSC-2026-0389 [1.01] [M/H] Kwetsbaarheid verholpen in WordPressKEV
  51. Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container EscapeEXPL
  52. Ransomware: emperador → RECEITA FEDERAL DO BRASILRANS
  53. CVE-2026-91777: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXMLVULN

  54. Tue 22 Sep 2026

    7 dispatches
    CISA adds CVE-2026-94127 (F5 BIG-IP APM) to the Known Exploited Vulnerabilities catalogKEV
  55. CISA adds CVE-2026-93616 (Check Point Multiple Products) to the Known Exploited Vulnerabilities catalogKEV
  56. GHSA-wx4m-69m9-gx3m: Home Assistant: XSS in Statistics Graph CardVULN
  57. GHSA-vv3m-f8x4-7377: lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdownVULN
  58. GHSA-frch-4w6v-q5xx: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksVULN
  59. GHSA-328g-jx67-v94g: Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostnameVULN
  60. GHSA-5jpj-293f-rhvj: KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 APIVULN