NewStart CGSL MAIN 7.02 : httpd Vulnerability (NS-SA-2026-0094)

The remote NewStart CGSL host, running version MAIN 7.02, has httpd packages installed that are affected by a vulnerability: - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to exec cmd=... directives...

CVE-2026-82069: Improper Removal of Sensitive Information Before Storage or Transfer

A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypasse...

CVE-2026-82066: Out-of-bounds Read

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. T...

PT-2026-87159

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A heap out-of-bounds read issue exists in the query planning component. An authenticated user with database read and write privileges can trigger this by using crafted query operations...

CVE-2026-86441

MISP (≤2.5.45) contains inconsistent authorization checks in organisation-related dashboard widgets. Several widgets failed to honor the Security.hide_organisation_index_from_users setting, allowing authenticated users lacking the perm_sharing_group permission to enumerate organisations despite t...

CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

Linux Distros Unpatched Vulnerability : CVE-2026-18708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed withi...

Linux Distros Unpatched Vulnerability : CVE-2026-18711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

GHSA-RGWJ-5XJ2-C3M3 vulnerabilities

Vulnerabilities for packages: sqlpad...

PT-2026-86571

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description An issue exists in the mysqli query function within the /admin/modal add product.php file. A remote attacker can perform a SQL injection by manipulating the fname variabl...

PT-2026-86567

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqli query of the file /admin/modal add coursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation of the attack is possible. The exploit...

PT-2026-86572

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description Remote SQL injection is possible through the manipulation of the room name variable within the mysqli query function located in the /admin/modal add room.php file. SQL...

PT-2026-86565

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli query of the file /admin/modal add course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been...

Malicious code in eth-query-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a24a29ae503dbb2bc291fcbd2d7eafdc92a6927a9a91bbda677e9b9b9b8c22 Package presents itself as an Ethereum RPC query helper but src/envcheck.cjs walks the caller's project tree on first use of the advertised...

MAL-2026-15982 Malicious code in eth-query-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a24a29ae503dbb2bc291fcbd2d7eafdc92a6927a9a91bbda677e9b9b9b8c22 Package presents itself as an Ethereum RPC query helper but src/envcheck.cjs walks the caller's project tree on first use of the advertised...

rdap v0.10.2

OpenRDAP is a command line RDAP client implementation in Go. https://www.openrdap.org - homepage https://www.openrdap.org/demo - live demo Features Command line RDAP client Output formats: text, JSON, WHOIS style Query types supported: ip domain autnum nameserver entity help url domain-search...

c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP

...

GHSA-MVXR-6M87-MV2Q vulnerabilities

Vulnerabilities for packages: commercial-gitlab-rails-ee, logstash, pghero, kube-logging-operator, pghero-fips, ruby3.3-mail, commercial-gitlab-rails-ee-fips...

SUSE CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...