Recent Advisories

Severity ID Title Vendor Product Date Type
CRITICAL 9.1 CVE-2026-54089

File Browser: Authentication Bypass via Proxy Auth Header Forgery_CVE-2026-54089

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting w...

filebrowser filebrowser >= 2.0.0-rc.1 CVE
CRITICAL 9.3 CVE-2026-54088

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)_CVE-2026-54088

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2...

filebrowser filebrowser < 2.63.6 CVE
HIGH 7.8 CVE-2026-53925

Glances: Arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration_CVE-2026-53925

Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interpret...

nicolargo glances >= 4.0.8, < 4.5.5 CVE
MEDIUM 5.3 CVE-2026-46611

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack_CVE-2026-46611

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glances/ser...

nicolargo glances < 4.5.5 CVE
HIGH 7.4 CVE-2026-46608

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)_CVE-2026-46608

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable ...

nicolargo glances < 4.5.5 CVE
HIGH 7.8 CVE-2026-46607

Glances: Insecure Pickle Deserialization in Version Cache Leads to Arbitrary Code Execution_CVE-2026-46607

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cac...

nicolargo glances < 4.5.5 CVE
HIGH 7.8 CVE-2026-46606

Glances: Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py_CVE-2026-46606

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engine...

nicolargo glances < 4.5.5 CVE
HIGH 8.4 CVE-2026-12921

Use after free in AzeoTech DAQFactory_CVE-2026-12921

In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files w...

AzeoTech DAQFactory CVE
HIGH 8.4 CVE-2026-12897

Out-of-bounds read in Horner Automation Cscape_CVE-2026-12897

Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsing CSP files. Successful exp...

Horner Automation Cscape CVE
NONE A34DF1A1-2F25-

pentest-agent-vs-llm-benchmark-effectiveness_A34DF1A1-2F25-5439-9D41-0DCBBBB34A45

Backbone or Backbone-Architecture? A controlled study of LLM agents on web-penetration-testing CTFs. The scaffold around the model often decides mo...

N/A N/A GITHUBEXPLOIT