64718 matches found
CVE-2024-58368
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...
OPENSUSE-SU-2026:21375-1 Security update for jackson-annotations, jackson-core, jackson-databind
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues: - CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions bsc1268902. - CVE-2026-59889: missing view guard when deserializi...
CVE-2026-16084 Sipeed PicoClaw web.go web_fetch server-side request forgery
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function webfetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and...
CVE-2026-9734
The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...
CVE-2026-16152: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /editrooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public...
PT-2026-60967
Name of the Vulnerable Software and Affected Versions urwid affected versions not specified Description The web display backend in urwid/display/web.py uses Python's Mersenne Twister PRNG to generate web session identifiers urwid id within the Screen.start function. Because this PRNG is not...
PT-2026-60986
A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made publi...
CVE-2026-16154: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /editroom1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The...
Linux Distros Unpatched Vulnerability : CVE-2026-9323
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that...
CVE-2026-7755
creationtimestamp| type| source ---|---|--- 2026-07-17 19:58:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqujxuzkyg2x 2026-07-17 22:08:31+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116937596000823068 2026-07-18 12:01:01+00:00| seen|...
GO-2026-5936 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers in github.com/zhenorzz/goploy
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and projectfile handlers in github.com/zhenorzz/goploy...
GHSA-Q38V-WP89-2W55 sh _uid does not drop supplementary groups (incomplete privilege drop)
Impact The uid option performed an incomplete privilege drop on Linux/Unix-like systems. When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...
CVE-2026-16016
creationtimestamp| type| source ---|---|--- 2026-07-17 18:34:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqufbrv4uc2x...
CVE-2026-12693
creationtimestamp| type| source ---|---|--- 2026-07-17 17:18:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mquaypxk6j2v 2026-07-17 18:45:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqufvswdpv2i 2026-07-19 09:00:36+00:00| seen|...
CVE-2026-63307
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...
CVE-2026-63307 Chat2DB < 5.3.0 Insecure Direct Object Reference via GET /api/connection/datasource
Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...
CVE-2026-63095 Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint
Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint witho...
CVE-2026-63093
creationtimestamp| type| source ---|---|--- 2026-07-17 15:16:22+00:00| seen| https://bsky.app/profile/suriq.io/post/3mqu272jdvo24 2026-07-17 18:39:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqufkqdbbk2x 2026-07-19 10:01:08+00:00| seen|...
