CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting (XSS) vulnerability in the user activation confirmation endpoint . The root cause is that the action query parameter is copied into the response and inserted into a hidden input attribute without HT...

CVE-2026-63360 LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Memorizzazione in chiaro di informazioni sensibili in memoria in Abacre Restaurant Point of Sale POS. Tutte le versioni di Abacre Restaurant Point of Sale POS fino alla 15.0.0.1656 sono vulnerabili alla memorizzazione in chiaro di informazioni sensibili in memoria...

PhantomCtx

PhantomCtx PhantomCtx ist ein Tool, das Aktivierungskontext-Hijacking automatisiert, mit dem Ziel, eine beliebige DLL in die überwiegende Mehrheit signierter ausführbarer Dateien z. B. Microsoft, Adobe, Mozilla zu laden. Der Loader wird als moderne Alternative zu traditionellem DLL Hijacking &...

CVE-2026-23111

CVE-2026-23111 PoC Linux Kernel nftables Use-After-Free Local Privilege Escalation poc by baba01hacker भेद्यता सारांश CVE : CVE-2026-23111 प्रकार : Use-After-Free CWE-416 CVSS : 7.8 HIGH घटक : net/netfilter/nftablesapi.c — nftmapcatchallactivate मूल कारण : उल्टी genmask जाँच लेन-देन रद्द होने के...

CVE-2026-77134

CVE-2026-77134 is a Broken Access Control vulnerability in the TYPO3 extension femanager . The extension fails to require the dedicated admin confirmation token when processing an admin-approval request. Instead, a regular user confirmation hash—obtainable by any visitor through the public resend...

CVE-2026-72700

The getgrav/grav-plugin-login Composer plugin (used by Grav CMS ) before version 3.9.1 compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939sessionactivate fail if the device is no longer registered. syzbot still reports: unregisternetdevice: waiting for vcan0 to become free. Usage count = 2. Even after commit 93a27b5891b8 “can: j1939: add missi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use clisactive to determine whether a class is active in qfqrmfromag. This is more of a preventive patch aimed at making the code more consistent and preventing possible exploits that involve manipulating child ql...

Astra Linux – Vulnerability in Firefox and Thunderbird

The error page for sites with invalid TLS certificates lacked the activation-delay feature provided by Firefox to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page triggered user clicks at specific locations immediately before...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtiopmem: Check the device status before requesting flushing. If a PMEM device is in an invalid state, the driver could wait indefinitely for the host acknowledgment in virtiopmemflush, causing the system to hang. Therefore, a...

azpim

Azure PIM CLI azpim Uma ferramenta de interface de linha de comando para gerenciar ativações de funções do Azure Privileged Identity Management PIM diretamente do seu terminal. Recursos 🔐 Ativação de Funções - Ative rapidamente funções elegíveis do Azure PIM 🔓 Desativação de Funções - Desative...

IntelTXE-PoC

अस्वीकरण सभी जानकारी केवल शैक्षिक उद्देश्यों के लिए प्रदान की गई है। इन निर्देशों का पालन अपने जोखिम पर करें। इस पृष्ठ में निहित जानकारी के आधार पर किसी व्यक्ति या संगठन द्वारा कार्य करने या न करने से उत्पन्न किसी भी प्रत्यक्ष या परिणामी क्षति या हानि के लिए न तो लेखक और न ही उनका नियोक्ता...

CVE-2026-74698

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq then unconditionally calls netdevtxresetqueue, zeroing the BQL...

CVE-2026-74698

This vulnerability affects the mlx5e network driver in the Linux kernel (used by Mellanox/NVIDIA ConnectX NICs). The root cause is that mlx5e_activate_txqsq() unconditionally calls netdev_tx_reset_queue(), which zeroes BQL (Byte Queue Limits) counters on channels that still have in-flight TX WQEs...

CVE-2026-74698 net/mlx5e: fix BQL reset on SQ re-activation

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq then unconditionally calls netdevtxresetqueue, zeroing the BQL...

CVE-2026-74698 net/mlx5e: fix BQL reset on SQ re-activation

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted. mlx5eactivatetxqsq then unconditionally calls netdevtxresetqueue, zeroing the BQL...

Linux Distros Unpatched Vulnerability : CVE-2026-74698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: fix BQL reset on SQ re-activation mlx5equeuestart deactivates and re-activates all channels but closes only the queue being restarted...

CVE-2026-76131

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...

EUVD-2026-63798

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...