CVE-2026-14632 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect

A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 95dfa8cebbb87ab46ae450643a07241274a74dce. Affected by this issue is the function setReferrer of the file application/core/MYController.php of the component Trusted Backend Interface. The manipulation of the argument hr...

PT-2026-55712

Name of the Vulnerable Software and Affected Versions kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions prior to de1c9e73ccf3bd032d9a0525c4752290d959dd8b Description A path traversal issue exists in the Vendor Image Manager component. A remote attacker can exploit this by manipulating the fold...

CVE-2026-14606 RT-Thread SWM341 CAN SWM341.h CAN_Receive stack-based overflow

A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CANReceive in the library bsp/synwit/libraries/SWM341CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The...

CVE-2026-14606

A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CANReceive in the library bsp/synwit/libraries/SWM341CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The...

SUSE CVE-2026-53339

In the Linux kernel, the following vulnerability has been resolved: i2c: qcom-cci: Fix NULL pointer dereference in cciremove On all modern platforms Qualcomm CCI controller provides two I2C masters, and on particular boards only one I2C master may be initialized, and in such cases the device...

SUSE CVE-2026-53357

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2capsockcleanuplisten vs l2capconndel btacceptdequeue unlinks a not-yet-accepted child from the parent accept queue and releasesocks it before returning, so the returned sk has no caller reference and is...

NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX696604)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is version 13.1 prior to 13.1-63.18, 14.1 prior to 14.1-72.61, 13.1-FIPS/NDcPP prior to 13.1-37.272, or 14.1-FIPS prior to 14.1-72.61. It is, therefore, affected by multiple vulnerabilities: -...

CVE-2026-24514 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2026-1580 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-JX8C-56MG-H6VP vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2026-24512 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-2PF9-VR92-6H3V vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-4G2F-XCPH-2335 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-9H3P-52VH-959W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2026-24513 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission. Description Craft CMS’s craft\controllers\AssetsController::actionMoveFolder supports moving an asset folder into a destination...

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and write...

Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets

Summary AssetsController::actionDeleteFolder only requires the deleteAssets: permission for the target folder. It never enforces deletePeerAssets:, even though Assets::deleteFoldersByIds cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A...

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Summary EntriesController::actionSaveEntry performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the o...

CVE-2026-50282 Craft CMS: Unauthorized Deletion of Destination Folders During Forced Moves

Craft CMS is a content management system CMS. Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function...