CRM Platform SQL Injection

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

AcyMailing < 10.11.1 - Unauthenticated SQL Injection

AcyMailing component for Joomla 10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input. id: CVE-2026-56292 info: name: AcyMailing 10.11.1 - Unauthenticated SQL Injection author: str4k3r severity:...

CVE-2026-115998

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

EUVD-2026-109262

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-115998

An Insecure Direct Object Reference (IDOR) vulnerability exists in Cervantes version v1.3-beta . This flaw allows an authenticated attacker to access sensitive data from projects they do not own, including proof-of-concept details , credentials , and client information . Furthermore, the attacker...

PT-2026-122566

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-93160

A flaw was found in the Linux kernel's atmel-ecc cryptographic driver. The hardware Elliptic Curve Diffie-Hellman ECDH computation could use a private key that was not generated for the current cryptographic operation. This issue arises because the public key is only cached after a private key is...

OESA-2026-4275 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

OESA-2026-4274 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

OESA-2026-4273 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

Astra Linux – Vulnerability in Linux

A flaw was discovered in the Linux kernel in versions prior to 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel. This allows anyone between the two endpoints to read the unencrypted...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. The Samba smbd file server must map Windows group identities SIDs to Unix group IDs gids. The code responsible for this mapping contained a flaw that could allow it to read data beyond the end of the array, in the event that a negative cache entry was added to the...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick in versions prior to 7.0.11. There is a potential for a cipher leak when calculating signatures using TransformSignature. The greatest threat of this vulnerability is related to data confidentiality...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, ther...

CVE-2026-106157 Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

EulerOS 2.0 SP13 : libkcapi (EulerOS-SA-2026-4062)

According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an...

EulerOS 2.0 SP11 : libkcapi (EulerOS-SA-2026-4338)

According to the versions of the libkcapi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Hotspot. The supported versions affected by this vulnerability are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK:...

CentOS Linux 6 [TuxCare] Security Update: libwebp / libwebp-devel / libwebp-java / libwebp-tools (CENTOS6:CLSA-2025:1758645375)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1758645375 advisory. - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid...