PT-2026-110792

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description The Query Console uses predictable Cross-Site Request Forgery CSRF tokens. CSRF is a technique where an attacker tricks...

PT-2026-110893

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description A denial of service can occur when executing a specially crafted query that utilizes a Materialized Query Table, which is a pre-computed table used to...

CVE-2026-104332: Stack-based Buffer Overflow

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table...

PT-2026-110813

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description Insufficient sanitization of input used by the Query Console file-exploration endpoint allows for HTTP response...

PT-2026-110648

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 12.1.0 Progress MarkLogic Server versions prior to 11.3.7 Description A remote attacker with query-execution access can invoke an XQuery evaluation function without the necessary evaluation privilege...

PT-2026-110482

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software versions prior to 10.3.1 Description An issue exists in the JWT Token Handler component within the file /auth/realms/default/protocol/openid-connect/logout. A remote attacker can manipulate the id token hint...

CVE-2026-85968: Out-of-bounds Read

Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory...

CVE-2026-109638: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

CVE-2026-85960: Cross-Site Request Forgery (CSRF)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...

PT-2026-110719

Name of the Vulnerable Software and Affected Versions Parse Server versions 8.2.2 through 8.6.93 Parse Server versions 9.0.0 through 9.10.1-alpha.13 Description GraphQL introspection control is only applied to operation text sent directly with a request and does not extend to operations resolved...

CVE-2026-108923: Improper Access Control

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...

CVE-2026-109674: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

CVE-2026-108168: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...

mihari

mihari Un agregador de consultas para la caza de amenazas basada en OSINT. Mihari puede agregar múltiples búsquedas a través de múltiples servicios en una sola regla y persistir los hallazgos en una base de datos. Mihari es compatible con los siguientes servicios por defecto. Censys CIRCL passive...

Malicious code in react-paginate-v5 (npm)

Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an implausibly high version 99.0.0 to win resolution against an...

netlas-cookbook

Netlas CookBook El objetivo de esta guía es enseñar a cualquier persona interesada en ciberseguridad, independientemente de su nivel de conocimiento, cómo aprovechar al máximo las herramientas de búsqueda de Netlas. Es una lectura extensa. Hemos recopilado la mayor cantidad posible de casos de us...

yeti

Plataforma Yeti Yeti tiene como objetivo cerrar la brecha entre los profesionales de CTI y DFIR al proporcionar una plataforma de inteligencia forense y un pipeline para equipos de DFIR. Nació de la frustración de tener que responder a la pregunta "¿dónde he visto este artefacto antes?" o "¿cómo...

reconerator

Resumen Este es un ensamblado .NET personalizado que realiza una serie de actividades de reconocimiento situacional. Hay varios conjuntos de funcionalidades actuales: BASIC - Obtiene información del disco y del registro. LDAP - Permite realizar consultas LDAP personalizadas de Active Directory...

MAL-2026-17777 Malicious code in react-paginate-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an...

wordlistgen

wordlistgen ¿Qué y por qué? wordlistgen es una herramienta para pasar una lista de URLs y obtener una lista de palabras relevantes para tus listas de palabras. Las listas de palabras son mucho más efectivas cuando tomas en cuenta el contexto de la aplicación. wordlistgen extrae componentes de URL...