13129 matches found
CVE-2026-77635
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...
UBUNTU-CVE-2026-77635
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...
pwnfaces
😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...
Astra Linux – Vulnerability in imagemagick
A vulnerability was discovered in ImageMagick-7.0.11-5, where executing a specially crafted file using the “convert” command allows ASAN to detect memory leaks...
CLSA-2026-1787560993 TuxCare security update for jquery (5 CVEs)
TuxCare rebuilt jquery to address 5 CVEs. Fixed in 2.1.3-tuxcare.1...
Linux Distros Unpatched Vulnerability : CVE-2026-62380
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection...
Zapscape-Fix — Updated!
Zapscape-Fix — CVE-2026-64561 Kernel Live Patch KVM/x86 English |简体中文 A kernel live patch that fixes CVE-2026-64561 Zapscape on CentOS Stream 8 / RHEL 8 KVM hosts all 4.18.0- kernels. Without the patch : a tenant VM guest can escape to the host with guest-side actions alone and execute code with...
EUVD-2026-62049
Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications component: Opera Servlet. Supported versions that are affected are 5.6.28.0-5.6.28.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...
EUVD-2026-61980
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the...
PT-2026-77899
Name of the Vulnerable Software and Affected Versions Oracle Java SE version 25.0.4 Oracle Java SE version 26.0.2 Description A flaw in the 2D component allows an unauthenticated attacker with network access via multiple protocols to compromise the system. This can lead to a hang or a frequently...
CLSA-2026-1786717612 TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 7 CVEs. Fixed in 6.0.23-tuxcare.5...
CVE-2026-15037 affecting package qtbase for versions less than 6.6.3-5
CVE-2026-15037 affecting package qtbase for versions less than 6.6.3-5. A patched version of the package is available...
CVE-2026-73299 Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Prompty is a markdown file format .prompty for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype propertie...
CLSA-2026-1786552823 TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 10 CVEs. Fixed in 5.3.7-tuxcare.5...
CLSA-2026-1786537061 TuxCare security update for org.apache.httpcomponents.client5 (1 CVE)
TuxCare rebuilt 5 org.apache.httpcomponents.client5 packages to address 1 CVE. Fixed in 5.5.2-tuxcare.1...
Security Bulletin:Vulnerability in Kerberos 5 affects IBM Netezza Appliance
Summary The Kerberos 5 package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-40355 Vulnerability Details CVEID:CVE-2026-40355 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls...
CVE-2026-72596
CVE-2026-72596 affects Ghost Foundation Ghost 5.x. A broken access control flaw allows authenticated users with the Author role to delete posts owned by others. The root cause is in the post model permissible() cascade: it lacks the branch that handles the combined isAuthor and isDestroy conditio...
EUVD-2026-56035
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...
CVE-2026-72596 Ghost Foundation Ghost - Broken Access Control
A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model permissible cascade is missing the branch that handles the combined isAuthor and isDestroy condition, causing the authorization check to...