[SECURITY] [DLA 4576-1] p7zip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4576-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler May 11, 2026 https://wiki.debian.org/LTS -...

MinIO 路径遍历漏洞

MinIO is an open-source object storage server developed by the American company MinIO. This product supports the creation of infrastructures for machine learning, analysis, and application data workloads. Versions of MinIO from RELEASE.2022-07-24T01-54-52Z to RELEASE.2026-04-14T21-32-45Z had a pa...

Ubuntu 16.04 LTS : ITK vulnerabilities (USN-8235-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8235-1 advisory. It was discovered that Expat, vendored in ITK incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute...

CVE-2022-50947

creationtimestamp| type| source ---|---|--- 2026-05-10 15:34:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlj3jk6mda2p...

CVE-2022-50949

creationtimestamp| type| source ---|---|--- 2026-05-10 15:19:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlj2ooxzbk2h...

CVE-2022-50958

creationtimestamp| type| source ---|---|--- 2026-05-10 14:51:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mliz4o526v2n...

CVE-2022-50960

creationtimestamp| type| source ---|---|--- 2026-05-10 14:50:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mliyzitiwi2k...

CVE-2022-50957

creationtimestamp| type| source ---|---|--- 2026-05-10 14:45:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mliyqyf3sj2k...

CVE-2022-50955

WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page...

CVE-2022-50943

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Attackers can inject JavaScript code via the search field in course/search.php to execute arbitrary scripts in users'...

UBUNTU-CVE-2022-50943

Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through the search parameter. Attackers can inject JavaScript code via the search field in course/search.php to execute arbitrary scripts in users'...

CVE-2022-50970

WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the tab parameter. Attackers can craft URLs with XSS payloads in the tab parameter of the aawp-settings admin page to execute arbitrar...

CVE-2022-50965

CVE-2022-50965 affects uBidAuction 2.0.1, specifically the posts/manage module. The vulnerability is a reflected cross-site scripting flaw where the filter functionality fails to sanitize the date_created, date_from, date_to, and created_at parameters, allowing an attacker to inject malicious scr...

CVE-2022-50964

The CVE-2022-50964 entry is for uBidAuction 2.0.1, affecting the auctions/myAuctions/status/loose module. The vulnerability is a reflected cross-site scripting (XSS) flaw caused by inadequate sanitization of the filter parameters date_created, date_from, date_to, and created_at in GET requests, a...

CVE-2022-50962

uBidAuction 2.0.1 is affected by a reflected XSS in the orders/myOrders module. The date_created, date_from, date_to, and created_at parameters in the filter functionality are not properly sanitized, allowing remote attackers to inject and execute malicious scripts via crafted GET requests in vic...

CVE-2022-50956

Affected software/impact: WordPress plugin amministrazione-aperta version 3.7.3 contains a local file read vulnerability. The root cause is insufficient input validation in the open parameter used by dispatcher.php, which allows unauthenticated attackers to supply file paths to read sensitive fil...

CVE-2022-50944

Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=addpost parameter, a...

CVE-2022-50965

creationtimestamp| type| source ---|---|--- 2026-05-10 04:16:34+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2022-50965 2026-05-10 15:02:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlizq35qfc2k...

CVE-2022-50963

creationtimestamp| type| source ---|---|--- 2026-05-10 04:16:34+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2022-50963 2026-05-10 14:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mliytoj2kk2c...

CVE-2022-50967

creationtimestamp| type| source ---|---|--- 2026-05-10 04:16:34+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2022-50967 2026-05-10 15:05:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlizuxjek52k...