•17 minutes ago•CVE-2026-54550
7.4CVE-2026-54550: Path Traversal Vulnerability in IzPack Installer Unpacker
IzPack versions 5.2.6 and earlier are vulnerable to path traversal via UnpackerBase.unpack(). The vulnerability allows unauthenticated attackers to write arbitrary files to the host filesystem during the installation process by crafting malicious installer packages containing directory traversal sequences.
0 views•4 min read
•about 1 hour ago•CVE-2026-54511
8.6CVE-2026-54511: Log Injection and Structured Data Key Injection in @logtape/syslog
CVE-2026-54511 is a critical security vulnerability in the @logtape/syslog package, which serves as the syslog sink for the LogTape logging library. The flaw is caused by a failure to neutralize C0 control characters in structured data values and to validate keys against RFC 5424 SD-NAME specifications when structured data output is enabled. Remote attackers can leverage this defect to terminate TCP syslog frames and append completely forged syslog records to downstream collectors, compromising the integrity of audit trails and SIEM databases.
2 views•6 min read
•about 2 hours ago•CVE-2026-54786
5.0CVE-2026-54786: Host File Descriptor Exhaustion in Wasmtime WASIp1 Runtime
A resource leak vulnerability in Wasmtime's WASIp1 native implementation of the fd_renumber system call allows guest WebAssembly applications to leak host file descriptors, ultimately leading to process-wide Denial of Service (DoS) via resource exhaustion.
2 views•8 min read
•about 3 hours ago•CVE-2026-55688
4.0CVE-2026-55688: Cookie Tossing / Cookie Injection Vulnerability in AsyncHttpClient
CVE-2026-55688 is a medium-severity cookie injection vulnerability in the AsyncHttpClient (AHC) library. Due to a failure to validate the domain attribute against the origin server during cookie handling, applications using a shared AHC client instance are vulnerable to cookie-tossing attacks.
3 views•5 min read
•about 4 hours ago•GHSA-93QJ-5Q5V-3C2H
0.0GHSA-93QJ-5Q5V-3C2H: Embedded Malicious Code in pantheon-agents PyPI Packages
A supply-chain compromise affecting the pantheon-agents PyPI package, where versions 0.6.1 and 0.6.2 were uploaded with malicious payloads that exfiltrate sensitive environment variables and credentials.
6 views•5 min read
•about 5 hours ago•GHSA-X287-5C68-36WP
7.1GHSA-X287-5C68-36WP: Broken Object-Level Authorization in OpenWISP IPAM Django Admin
A broken object-level authorization (BOLA) vulnerability exists in the Django Admin custom export view of OpenWISP IPAM. This flaw allows a multi-tenancy restricted staff user to export subnets and associated IP addresses belonging to different organizations by supplying a targeted subnet identifier in the export request.
3 views•6 min read
•about 6 hours ago•CVE-2026-54563
7.1CVE-2026-54563: Path Traversal and Incorrect Authorization in Cloudreve WebDAV Component
A high-severity path traversal vulnerability in Cloudreve's WebDAV component allows authenticated users with scoped WebDAV credentials to bypass directory containment limits and access unauthorized filesystem areas.
3 views•5 min read
•about 7 hours ago•CVE-2026-54606
8.5CVE-2026-54606: DOM-based Cross-Site Scripting via Programmatic Script Recreation in SunEditor Embed Plugin
A DOM-based Cross-Site Scripting (XSS) vulnerability was identified in SunEditor before version 3.1.4. The Embed plugin programmatically recreated and mounted script elements from raw HTML embed code, permitting remote attackers to execute arbitrary JavaScript within a user's browser session.
3 views•6 min read
•about 8 hours ago•CVE-2026-54569
9.8CVE-2026-54569: Remote Code Execution via Missing Authorization and Eval Injection in senaite.core
SENAITE LIMS core framework (senaite.core) versions 2.0.0 through 2.6.0 contain a critical vulnerability chain that permits unauthenticated remote code execution. By combining a Missing Authorization flaw (CWE-862) in multiple JSON API endpoints with an Unsafe Evaluation flaw (CWE-95) during custom field deserialization, an attacker can execute arbitrary Python commands. This execution occurs under the privileges of the hosting Zope process, creating severe risk to laboratory systems, physical instrumentation databases, and host system integrity.
3 views•7 min read
•about 9 hours ago•GHSA-7W8C-QGXG-M7JX
8.0GHSA-7W8C-QGXG-M7JX: Stored Cross-Site Scripting in LibreNMS Legacy Templates
A Stored Cross-Site Scripting (XSS) vulnerability exists within the legacy presentation templates of the LibreNMS network monitoring system. Due to inadequate context-aware output encoding of operational data ingested via Simple Network Management Protocol (SNMP) polling, Border Gateway Protocol (BGP) notifications, and incoming Syslog messages, an administrative user viewing device dashboards can be targeted with arbitrary JavaScript execution.
3 views•6 min read
•about 10 hours ago•CVE-2026-54614
4.3CVE-2026-54614: Unsafe Reflection and Arbitrary Class Instantiation in cakephp/debug_kit MailPreview
CVE-2026-54614 is an unsafe reflection vulnerability in the MailPreview component of cakephp/debug_kit prior to versions 4.10.3 and 5.2.4. Unauthenticated or low-privileged remote attackers can exploit this vulnerability to dynamically resolve and instantiate arbitrary PHP classes within the Composer autoloader environment, leading to constructor and destructor execution.
3 views•7 min read
•about 11 hours ago•CVE-2026-54590
5.9CVE-2026-54590: Path Traversal and Authentication Bypass in AsyncSSH via Username Token Substitution
An incomplete input sanitization fix in AsyncSSH version 2.23.0 allows unauthenticated remote attackers to bypass directory restriction controls and perform path-traversal attacks. When the system is configured to perform username token substitution inside its AuthorizedKeysFile directive, attackers can manipulate downstream path resolution mechanisms via tilde expansion and environment variable references. This flaw permits authentication bypasses by forcing the server to read public keys from unauthorized file locations outside the restricted environment.
4 views•6 min read