CVE-2026-84859 Scada-LTS Authenticated Blind SQL Injection

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization...

EUVD-2026-80826

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization...

CVE-2026-84859

ScadaLTS 2.8.1-release-candidate build 0 is affected by an authenticated blind SQL injection in the /api/events/search endpoint. The sortBy array values in the JSON request body are concatenated directly into the SQL ORDER BY clause without sanitization or parameterization, enabling time-based an...

CVE-2026-92468

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...

EUVD-2026-80785

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can...

CVE-2026-92366 code-projects Matrimonial System Regular Search search.php sql injection

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can...

CVE-2026-92366

code-projects Matrimonial System 1.0 is vulnerable to SQL injection in the Regular Search component via the /search.php file. Unauthenticated remote attackers can manipulate the arguments sex, mothertongue, maritialstatus, country, state, religion, agemin, and agemax to inject SQL. The impact is ...

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

Summary The OpenTelemetry.Resources.Host NuGet package is affected by an untrusted search path vulnerability on macOS. The host.id resource attribute detector launches the sh and ioreg executables by bare name rather than by absolute path, so both are resolved through the PATH environment variabl...

EUVD-2026-74187

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS...

CVE-2026-92468

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass in the search-center service. An authenticated attacker can read any Elasticsearch index by supplying the index name in the path variables of POST /search/{indexName} and GET /agg/requestStat/{indexName}/{routing}, with...

EUVD-2026-80706

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...

CVE-2026-92468 microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...

CVE-2026-92468 microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...

CVE-2026-92468 microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/indexName and GET /agg/requestStat/indexName/routing path...

CVE-2026-92587: Untrusted Search Path

n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath but then invoked git with that path as its working directory; git walked up to the enclosing repository's top level and resolv...

PT-2026-93870

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description A legacy Express entry search endpoint returns entry result JSON without invoking the canViewExpressEntries permission check. This allows an unauthenticated visitor who possesses an Express enti...

CVE-2026-18120: Missing Authorization

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

PT-2026-93734

Name of the Vulnerable Software and Affected Versions zlt2000 microservices-platform versions prior to 6.0.0 Description An authorization bypass exists in the search-center service. Authenticated attackers can read any Elasticsearch index by specifying the index name in the path variables of the...

PT-2026-93952

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance ASA Software affected versions not specified Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description A logic error in the access control list ACL Object...

CVE-2026-20120: Improper Access Control

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...