ROS-20261002-73-0105

The vulnerability of the amcheck extension in the PostgreSQL database management system is related to the use of an insecure search path. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary code by manipulating the searchpath parameter...

ROS-20261002-73-0148

The vulnerability of the contact search component in the SOGo collaborative work software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain unauthorized access to protected information...

ROS-20261002-73-0032

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0035

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

PT-2026-104196

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...

PT-2026-104161

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

PT-2026-104195

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”...

CVE-2026-103631: Heap-based Buffer Overflow

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103630: Use After Free

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84411: Integer Underflow (Wrap or Wraparound)

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code execution as root, or to cause a denial of...

CVE-2026-94422: Authentication Bypass by Spoofing

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

CVE-2026-59667: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...

CVE-2026-95662: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

CVE-2026-59673: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTipoCli” parameter is affected – endpoint “/es/clientypes/update/109441”...

CVE-2026-59672: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected – endpoint "/es/corporategroups/update/246”...

CVE-2026-59665: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomMotivo” parameter is affected – endpoint “/es/lostmotives/store”...

CVE-2026-59662: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

CVE-2026-93029: Improper Neutralization of Input During Web Page Generation

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface...

CVE-2026-93697: Improper Neutralization of Input During Web Page Generation

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface...

CVE-2026-59659: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomZonaGeo” parameter is affected – endpoint “/es/geozones/update/149979”...