Astra Linux – Vulnerability in python-future

A vulnerability discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service by using a crafted Set-Cookie header from a malicious web server...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11, when PHP processes incoming HTTP cookie values, the cookie names are url-decoded. This may result in cookies with prefixes like Host being confused with cookies that are decoded with such prefixes. As a consequence,...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.0 to 2.4.46: A specially crafted Cookie header handled by modsession can lead to a NULL pointer derefrence error and system crash, potentially causing a Denial Of Service attack...

CVE-2026-90708

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90708

Yot CMS versions up to 3.3.1 contain a SQL injection vulnerability in the Login function within the Cookie Handler component (file: global.php ). An attacker can manipulate the yot3_user and yot3_pass arguments to inject SQL, enabling remote exploitation without authentication or user interaction...

EUVD-2026-77384

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90708 Yot CMS Cookie global.php login sql injection

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90708 Yot CMS Cookie global.php login sql injection

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

Important: mod_auth_openidc

Issue Overview: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser...

CVE-2026-7884: Improper Neutralization of Input During Web Page Generation

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...

CVE-2026-90708: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

Important: mod_auth_openidc

Issue Overview: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser...

Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)

The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...

Amazon Linux 2023 : mod_auth_openidc (ALAS2023-2026-2155)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2155 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an...

PT-2026-91732

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 Description A non-privileged user can inject malicious JavaScript code by editing their given name and surname. The code executes...

PT-2026-91170

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3 user/yot3 pass causes sql injection. It is possible to initiate the attack remotely. The explo...

EUVD-2026-76742

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

Linux Distros Unpatched Vulnerability : CVE-2026-89479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: stop processing a packet once its association is deleted sctpendpointbhrcv looks the association up only when chunk-asoc is NULL, and caches the result in...

CVE-2026-78175: Deserialization of Untrusted Data

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

Linux Distros Unpatched Vulnerability : CVE-2026-89554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: fix uninitialized localid in syncookie MPJOIN reconstruction mptcptokenjoincookieinitstate restores remotenonce, localnonce, backup, joinid, token and ms...