106272 matches found
DEBIAN-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
UBUNTU-CVE-2026-81525
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-37068
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
CVE-2026-81525
CVE-2026-81525 is a cross-tenant database retargeting vulnerability in the MongoDB client library for PHP (mongo-php-library and mongo-php-driver). The root cause is insufficient sanitization of dot and NUL characters in application-supplied namespace identifiers, allowing an attacker with low pr...
CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-81525
Removed by vendor...
CVE-2026-81525 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP Driver
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...
CVE-2026-54718 Silverstripe Advanced Workflow: Remote code execution via advanced workflow email template
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...
CVE-2026-54718
Silverstripe Advanced Workflow (the symbiote/silverstripe-advancedworkflow module) is vulnerable to remote code execution prior to versions 6.4.5, 7.1.3, and 7.2.1. An attacker with permission to author the advanced workflow email template can inject a specially crafted server-side template paylo...
EUVD-2026-67242
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...
cve-analysis-exploitation-mitigation
CVE Analysis, Exploitation & Mitigation A hands-on cybersecur...
EUVD-2026-67044
opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...
CVE-2026-40526
Volmarg Personal Management System contains a path traversal vulnerability in the GET /public/get-file/{path} endpoint. The path parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, allowing an authenticated attacker to read arbitrary fi...
CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2026-40526 Volmarg Personal Management System Path Traversal via get-file Endpoint
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2018-16370
creationtimestamp| type| source ---|---|--- 2026-08-27 12:00:11+00:00| seen| Telegram/SVZvTdeqqmSRakJEIQhn4CjyThzPklzbZgbnjRRXOSeUVHM 2026-08-28 00:00:55+00:00| seen| Telegram/SVZvTdeqqmSRakJEIQhn4CjyThzPklzbZgbnjRRXOSeUVHM 2026-08-29 00:00:15+00:00| published-proof-of-concept|...