CVE-2026-25936

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue...

CVE-2026-25936

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue...

UBUNTU-CVE-2026-25936

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue...

EUVD-2026-12627

GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injection. Version 11.0.6 fixes the issue...

How to Prioritize Vulnerabilities Effectively: A Framework

Attackers don’t care about your massive backlog of "critical" vulnerabilities. They look for the path of least resistance—the one exploitable weakness that gives them a foothold into your network. If your vulnerability management program isn't thinking like an attacker, you're always one step...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the html2BlockDOM handler in kernel/api/lute.go and the asset-copying process in the desktop publish service. An attacker can exfiltrate sensitive local files readable by the desktop process by submitting HTM...

Malicious code in asset-delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff566136dd4e76e6bc8da12a23345712a57b375d3d0586ee36922cc0ffbbf880 The package asset-delivery was found to contain malicious code. Source: ghsa-malware ce9daf86327543018f44899bd8967bf2b927d6f1d9267b6726281b5ea0765868...

MAL-2026-1489 Malicious code in asset-delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff566136dd4e76e6bc8da12a23345712a57b375d3d0586ee36922cc0ffbbf880 The package asset-delivery was found to contain malicious code. Source: ghsa-malware ce9daf86327543018f44899bd8967bf2b927d6f1d9267b6726281b5ea0765868...

Malicious Package

Overview asset-delivery is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-25929

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.5 Description GLPI is a free Asset and IT management software package. An authenticated user can perform a SQL injection. The SQL injection can be performed through unspecified vectors. Recommendations Update ...

PT-2026-25959

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.5 Description GLPI is an Asset and IT management software package. A malicious actor with knowledge of a user's credentials can bypass Multi-Factor Authentication MFA and compromise the account. The issue...

Top 5 Vulnerability Prioritization Tools for Enterprises

A high CVSS score doesn’t always equal high business risk. A critical vulnerability on a non-essential, isolated asset might be less of a priority than a medium-level one on your primary payment server. To truly manage risk, you have to connect technical data to business context. This means...

PT-2026-25803

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.4 Craft CMS versions 5.0.0-RC1 through 5.9.10 Description Craft CMS is a content management system. The AssetsController-replaceFile method uses the targetFilename body parameter without proper...

Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006193)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006193 advisory. A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of t...

Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006192)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006192 advisory. A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function...

Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006180)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006180 advisory. A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic. Affected by this issue is the function...

Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006186)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006186 advisory. A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the librar...

CVE-2026-22248

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP...

CVE-2026-22248 GLPI affected by Remote Code Execution via malicious upload

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. From 11.0.0 to before 11.0.5, an authenticated technician user can upload a malicious file and trigger its execution through an unsafe PHP...

Microsoft Graph Advanced Intelligence Collector

This Metasploit auxiliary module interacts with the Microsoft Graph API to perform advanced intelligence collection in Microsoft 365 environments. The module supports Azure AD application authentication or direct access tokens and enables enumeration of Azure users, SharePoint sites, OneDrive...