9205 matches found
Chamilo LMS security vulnerabilities
Chamilo LMS is an open-source online learning and collaboration system developed by Chamilo. This system supports the creation of teaching content, remote training, and online quizzes. Version 1.11.2 of Chamilo LMS contains a security vulnerability. This vulnerability stems from insufficient...
GHSA-F2PH-GC9M-Q55F lakeFS is Missing Timestamp Validation in S3 Gateway Authentication
Impact LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request e.g., through network interception, logs, or compromised systems can replay that request until credentials are rotated, even after the reques...
CVE-2026-0976
A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments,...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002280)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002280 advisory. net/netfilter/nfconntrackprotogeneric.c in the Linux kernel before 3.18 generates incorrect conntrack entries during handling of certain iptables rule sets for the...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003193)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003193 advisory. The preparevmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the CR8-load exiting and CR8-store exiting L0 vmcs02 control...
EUVD-2026-2458
A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby...
[SECURITY] Fedora 43 Update: complyctl-0.1.2-1.fc43
complyctl leverages OSCAL to perform compliance assessment activities, using plugins for each stage of the life-cycle...
EUVD-2026-2614
EUVD-2026-2614...
The vulnerability of the GNU Tar archive manager arises from an incorrect limitation on the path to the restricted-access directory. This allows attackers to circumvent existing security restrictions and gain access to the files for overwriting.
The vulnerability of the GNU Tar archive editor is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability could allow a attacker to bypass existing security restrictions and gain access to the files for overwriting...
PT-2026-38954
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ov5647 init controls function where v4l2 get subdevdata is called before the subdevice is initialized by v4l2 i2c subdev init during the probe process. This...
Schneider Electric EcoStruxure Power Build Rapsody (Update A)
GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install physical controls so no unauthorized personnel can access...
Authentication Bypass
Ollama is vulnerable to an Authentication Bypass. The vulnerability is due to where critical model management APIs are exposed without access controls, allowing remote attackers to perform unauthorized operations without authentication...
libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins)
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the...
CVE-2026-22490
Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Landing Page Creator for WordPress LPagery: from n/a through = 2.4.9...
CVE-2005-1908
Perception LiteWeb allows remote attackers to bypass access controls for files via an extra leading / slash or leading \ backslash in the URL...
CVE-2023-50918
app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs...
CVE-2023-4546
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230816. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /sysmanage/licence.php. The manipulation leads to improper access controls. The exploit has been disclosed...
Are we ready for ChatGPT Health?
How comfortable are you with sharing your medical history with an AI? I’m certainly not. OpenAI’s announcement about its new ChatGPT Health program prompted discussions about data privacy and how the company plans to keep the information users submit safe. ChatGPT Health is a dedicated “health...
CVE-2018-18819
A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 7.3.0.601 and earlier, and 8.0 8.0.0.40 through 8.0 SP2 FP2 8.0.2.202, and MiVoice Business Express versions 7.3 PR3 7.3.1.302 and earlier, and 8.0 8.0.0.40 through 8.0 SP2 FP1 8.0.2.202, could allow creation of...