Medium: mariadb1011

Issue Overview: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability...

CVE-2026-109566: Use of Hard-coded Credentials

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

CVE-2026-108896: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-108907: Improper Authentication

A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function userok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted...

CVE-2026-108906: Out-of-bounds Read

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filterarpputfilecgi of the file /router/filterarpputfile.cgi. The manipulation of the argument putfile leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-108777: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. Th...

CVE-2026-21114: Out-of-bounds Write

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...

Important: sudo

Issue Overview: A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2026-013)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2026-013 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes...

PT-2026-110643

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 12.1.0 Progress MarkLogic Server versions prior to 11.3.7 Description An authorization flaw exists that allows a remote attacker with administrative privileges to access authentication material...

PT-2026-111097

Name of the Vulnerable Software and Affected Versions IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 Description A remote attacker can cause a denial of service by triggering uncontrolled resource consumption. Recommendations At the moment, there is no information about a newer versio...

CVE-2026-21116: Undefined Security Weakness

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-108782: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulati...

UBUNTU-CVE-2026-107565

A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup LUKS device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free spa...

CVE-2026-21115: Undefined Security Weakness

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-108788: Undefined Security Weakness

A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has...

CVE-2026-109638: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

PT-2026-110438

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 9.5.6 Build 20260130.3206 Description A remote attack can be launched to manipulate unknown processing, resulting in the use of a hard-coded cryptographic key. Recommendations At the moment, there is no information about...

CVE-2026-108815: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...