CVE-2025-70890

A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0 . An authenticated attacker can inject arbitrary JavaScript code into the username parameter via the add-users.php endpoint. The malicious payload is stored and subsequently executed in the victim's brow...

CGA-6Q55-3G2W-WVJP

Bulletin has no description...

CVE-2025-71113

A flaw was found in the Linux kernel's crypto AFALG subsystem. Memory allocated via sockkmalloc for crypto user API contexts is not zero-initialized, leaving fields with garbage values. Specifically, the 'inflight' variable can contain random data, causing afalgallocareq to spuriously return -EBU...

CGA-5FG6-5649-3R9W

Bulletin has no description...

CVE-2025-71086

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rosekillbydevice rosekillbydevice collects sockets into a local array and then iterates over them to disconnect sockets bound to a device being brought down. The loop mistakenly indexes...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001758)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001758 advisory. Linux disk/nic frontends data leaks This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE...

CVE-2023-36331

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

EUVD-2026-2206

Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network...

CVE-2025-14507

CVE-2025-14507 — EventPrime for WordPress suffers unauthenticated sensitive information exposure via the REST API in all versions up to and including 4.2.7.0. Unauthenticated attackers could exfiltrate booking data (user names, emails, ticket details, payment information, and order keys) when the...

PT-2026-2485

CVE-2025-65783 An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary… https://t.co/LqnyiifjdF...

CVE-2023-36331: Authorization Bypass Through User-Controlled Key

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

CVE-2023-36331

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

EUVD-2023-40299

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId...

Fedora: Security Advisory (FEDORA-2026-66162d01ae)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EUVD-2026-1882

OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has bee...

CVE-2026-22605: Improper Access Control

OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has bee...

OpenProject access control vulnerability

OpenProject is a Web-based project management software from OpenProject Open Source. An Access Control Error vulnerability exists in versions prior to OpenProject 16.6.3, which stems from improper access control and could lead to unauthorized access to meeting details...

GHSA-W3G8-FP6J-WVQW SM2-PKE has 32-bit Biased Nonce Vulnerability

Summary A critical vulnerability exists in the SM2 Public Key Encryption PKE implementation where the ephemeral nonce k is generated with severely reduced entropy. A unit mismatch error causes the nonce generation function to request only 32 bits of randomness instead of the expected 256 bits. Th...

CVE-2023-40266

An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal...

CVE-2018-1000841

Zend.To version Prior to 5.15-1 contains a Cross Site Scripting XSS vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. This attack appear to be exploitable via HTTP POST request. This vulnerability...