EUVD-2026-101677

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxyoffer/rtpproxyanswer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resol...

CVE-2026-110679 OpenSIPS rtpproxy rtpproxy_answer out-of-bounds

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxyoffer/rtpproxyanswer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resol...

CVE-2026-110679

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxyoffer/rtpproxyanswer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resol...

CVE-2026-110679

The OpenSIPS software is vulnerable in versions up to 3.6.8 and 4.0.1 due to an out-of-bounds read vulnerability. The flaw exists within the rtpproxy_offer/rtpproxy_answer functions of the rtpproxy component, which can be triggered through remote manipulation. This vulnerability could allow an at...

CVE-2026-110679 OpenSIPS rtpproxy rtpproxy_answer out-of-bounds

A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxyoffer/rtpproxyanswer of the component rtpproxy. This manipulation causes out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 and 4.0.2 is sufficient to resol...

CVE-2026-0311 Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...

EUVD-2026-101676

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services...

CVE-2026-110310

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-110670 cemtan sar2html Archive Processing sar2html.py updateDb sql injection

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the...

CVE-2026-110670

A SQL injection vulnerability exists in cemtan sar2html version 4.0.0 within the Archive Processing component. The flaw is located in the updateDb function of the sar2html.py file, where improper handling of the s2host argument allows for remote execution of unauthorized SQL commands. While the p...

CVE-2026-110670 cemtan sar2html Archive Processing sar2html.py updateDb sql injection

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the...

CVE-2026-55684

The WeGIA web manager for charitable institutions is vulnerable to SQL Injection in the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint prior to version 3.8.6 . The application improperly handles form-encoded POST data via extract($_REQUEST), interpolating multiple parameters—inclu...

CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-55683 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

CVE-2026-55683

The WeGIA web manager for charitable institutions contains an SQL Injection vulnerability in the web/html/socio/sistema/cadastro_cobranca.php endpoint. Prior to version 3.8.6 , the application fails to use prepared statements when processing POST input via extract($_REQUEST). Specifically, the pa...

CVE-2026-55683 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

CVE-2026-110310

The Amazon S3 Encryption Client for .NET is vulnerable to an RSA PKCS#1 v1.5 padding oracle attack. A remote user capable of reading encrypted objects in an S3 bucket can force a padding downgrade by modifying an object's metadata to use the legacy PKCS#1 v1.5 scheme. This vulnerability allows th...

CVE-2026-110310

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

EUVD-2026-101618

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...