A command-line utility and protocol implementation that provides remote terminal access to remote hosts over a network, part of the GNU InetUtils package. Telnet allows users to establish a text-based connection to remote systems for management and configuration purposes. The GNU InetUtils version is a free software implementation of the telnet protocol maintained by the GNU Project.

GNU InetUtils Telnet

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Gentoo is a highly flexible, source-based Linux distribution.

Linux Gentoo

Echo is a secure, minimal Linux OS built vulnerability-free. It is fully compatible across environments and continuously patched - making it a clean, dependable base layer for modern applications. Echo is used by organizations focused on security and reliability, including those with compliance or FIPS requirements.

Echo

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

CVE-2026-24061

Debian

Debian Security Tracker

Gentoo

Gentoo Advisory Database

Linux

Linux Kernel

VulnCheck NVD++

A module that enables Apache HTTP Server to communicate with WebLogic Server instances, allowing Apache to forward requests to WebLogic Server and receive responses back. The plug-in handles load balancing, failover, and SSL communication between Apache and WebLogic servers.

Weblogic Server Proxy Plug-in for Apache HTTP Server

Oracle WebLogic Server Proxy Plug-in for IIS enables requests to be proxied from Microsoft Internet Information Services (IIS) to WebLogic Server. It provides load balancing, failover, and SSL support for web applications deployed on WebLogic Server.

Weblogic Server Proxy Plug-in for IIS

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

CVE-2026-21962

Windows

Windows Cumulative Update

NixOS is a Linux distribution built on top of the Nix package manager. It is completely declarative, its system configurations are reproducible, makes configuration changes reliable and atomic, and eliminates configuration drift.

NixOS

A workflow automation platform that allows users to create, automate, and integrate workflows between different services and applications through a visual interface, supporting both cloud-hosted and self-hosted deployments.

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.

CVE-2026-21858

GitHub Advisory Database

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted.

CVE-2025-68697

n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.

CVE-2025-68668

A security flaw has been discovered in pymumu SmartDNS up to 47.1. This vulnerability affects the function _dns_decode_rr_head/_dns_decode_SVCB_HTTPS of the file src/dns.c of the component SVBC Record Parser. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The patch is identified as 2d57c4b4e1add9b4537aeb403f794a084727e1c8. Applying a patch is advised to resolve this issue.

CVE-2026-1425

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.

CVE-2025-14973

The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVE-2025-14316

A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue.

CVE-2026-1418

A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: f96bd57c3ccdcde4335a0be28cd3e8fe296993de. Applying a patch is the recommended action to fix this issue.

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2026-24061	CRITICAL	9.8	GNU InetUtils Telnet	inetutils	No	Sì	Jan 21, 2026
CVE-2026-21962	CRITICAL	10	Weblogic Server Proxy Plug-in for Apache HTTP Server	cpe:2.3:a:oracle:weblogic_server_proxy_plug-in	No	No	Jan 20, 2026
CVE-2026-21858	CRITICAL	10	NixOS	n8n	No	Sì	Jan 08, 2026
CVE-2025-68697	MEDIUM	5.4	NixOS	n8n	No	Sì	Dec 26, 2025
CVE-2025-68668	CRITICAL	9.9	NixOS	n8n	No	Sì	Dec 26, 2025

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2026-1425	MEDIUM	6.3	Linux Debian	smartdns	No	No	Jan 26, 2026
CVE-2025-14973	N/A	N/A	WordPress	recipe-card-blocks-by-wpzoom	No	Sì	Jan 26, 2026
CVE-2025-14316	N/A	N/A	WordPress	ahachat-messenger-marketing	No	No	Jan 26, 2026
CVE-2026-1418	MEDIUM	4.8	Linux Debian	gpac	No	No	Jan 26, 2026
CVE-2026-1417	MEDIUM	4.8	Linux Debian	gpac	No	No	Jan 26, 2026

Database delle vulnerabilità Wiz

Esplora per tecnologia

Filtri popolari

Alto profilo

Più recenti

I numeri delle vulnerabilità

Il buono, il cattivo e il vulnerabile

Ulteriori risorse Wiz

PEACH

Pronti a vedere Wiz in azione?