CVE-2026-30655

The esiclivre/esiclivre project (versions v0.2.2 and earlier ) is vulnerable to a remote SQL injection within the Solicitante::resetaSenha() function. An unauthenticated attacker can exploit this by submitting malicious input via the cpfcnpj POST parameter at the /reset/index.php endpoint. The ro...

ROS-20260324-73-0035

A vulnerability in the net/netfilter/xtnfacct.c component of the Linux operating system kernel is related to reading outside the allowed data buffer boundaries. Exploitation of the vulnerability allows an attacker to gain access to sensitive data and cause a denial of service...

The vulnerability of the xfrm_input() function in the net/xfrm/xfrm_input.c module of the Linux operating system allows a hacker to gain access to protected information or cause a service failure.

The vulnerability of the xfrminput function in the net/xfrm/xfrminput.c module of the Linux kernel is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

Oracle Linux 9 : opencryptoki (ELSA-2026-5603)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-5603 advisory. 3.25.0-4.2 - Resolves: RHEL-144820, Privilege Escalation or Data Exposure via Symlink Following Tenable has extracted the preceding description block directly...

opencryptoki security update

3.25.0-4.2 - Resolves: RHEL-144820, Privilege Escalation or Data Exposure via Symlink Following...

PT-2026-27372

Meeplace Business Review Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to the addclick.php endpoint with crafted SQL payloads in the 'id'...

RHEL 9 : opencryptoki (RHSA-2026:5603)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:5603 advisory. The opencryptoki packages contain version 2.11 of the PKCS11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These...

PT-2026-27633

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.2.0 Description The GET /api/allusers API endpoint is publicly accessible, allowing remote unauthenticated user enumeration and exposure of user profile metadata. The route is registered under public routes in...

CVE-2026-33211

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permissi...

CVE-2026-23487

Blinko, an AI-powered card note-taking project, has a vulnerability CVE-2026-23487 in the user.detail endpoint (IDOR) that can leak the superadmin token. Affected are versions prior to 1.8.4; the root cause is improper access control on that endpoint. The issue has been patched in version 1.8.4. ...

CVE-2026-23486 Blinko: Unauthorized User Information Leak

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4...

CVE-2026-23486

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, a publicly accessible endpoint exposes all user information, including usernames, roles, and account creation dates. This issue has been patched in version 1.8.4...

CVE-2026-33723

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Subscribe::save method in objects/subscribe.php concatenates the $this-usersid property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from...

WordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by CidKagenouSama in WordPress Plugin Contact Form by WPForms versions = 1.9.8.7...

CVE-2026-33485 AVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP onpublish callback at plugin/Live/onpublish.php is accessible without authentication. The $POST'name' parameter stream key is interpolated directly into SQL queries in two locations —...

⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More

Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories. This edition covers a mix of issues: supply chain attacks hitting CI/CD setups, long-abused IoT devices being shut down...

WordPress Review Schema plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Doan Dinh Van in WordPress Plugin Review Schema versions = 2.2.6...

EUVD-2026-14408

A flaw has been found in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. This affects an unknown part of the component Cardholder Data Handler. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack requires access to the local network. The attack requires ...

WordPress DirectoryPress plugin <= 3.6.26 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin DirectoryPress versions = 3.6.26...

EUVD-2025-208928

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated...