MiracleLinux 9 : git-2.39.1-1.el9 (AXSA:2023-5623:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5623:05 advisory. git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree CVE-2022-24765 git: Bypass of safe.directory protections...

CVE-2026-1175

A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component GraphQL Directive Handler. Such manipulation leads to information exposure through error message. The attack may be performed from remote. The exploit is...

CVE-2025-52659 HCL AION is affected by a Cacheable HTTP Response vulnerability

HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure...

CVE-2026-1181 Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing CORS policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could...

CVE-2026-1181 Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing CORS policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including forum.live.altium.com. As a result, JavaScript executing on those origins could...

ROS-20260119-7375

A vulnerability in the fs/nilfs2 component of the Linux kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability may allow an attacker to gain access to sensitive data, compromise its integrity, and cause denial of service...

CVE-2026-23844: Exposure of Data Element to Wrong Session

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue...

CVE-2026-23944: Missing Authentication for Critical Function

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled...

📄 Chamillo LMS 1.11.2 Missing Cache Header

Chamillo LMS version 1.11.2 is missing a cache header that leads to information disclosure. CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing...

PT-2026-3468

HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure...

Huawei HarmonyOS Memo Module Privilege Control Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A privilege control vulnerability exists in the Huawei HarmonyOS memo module, which can be exploited by an attacker to compromise confidentiality...

ROS-20260119-7360

A vulnerability in the smusyssetpptable function of the drivers/gpu/drm/amd/pm/swsmu/amdgpusmu.c component of the Linux kernel is related to buffer copying without input data validation. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data, compromise its...

ROS-20260119-7393

A vulnerability in the pcf85063nvmemread function of the drivers/rtc/rtc-pcf85063.c component of the Linux operating system kernel is related to writing beyond buffer boundaries. Exploitation of the vulnerability may allow an attacker to gain access to sensitive data, violate its integrity, and...

Qnap QTS and QuTS hero Improper Limitation of a Pathname to a Restricted Directory (CVE-2023-51364)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions:...

The vulnerability of Google Chrome’s Digital Credentials component allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of Google Chrome’s Digital Credentials component is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected information...

MiracleLinux 3 : firefox-24.4.0-1.0.1.AXS3 (AXSA:2014-233:01)

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-233:01 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security issues fixed with this releas...

ROS-20260119-7376

A vulnerability in the ax25 component of the Linux operating system kernel is related to the use of memory after it has been freed. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data, compromise its integrity, and cause a denial of service...

MiracleLinux 7 : xfsprogs-3.2.2-2.el7 (AXSA:2015-743:01)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2015-743:01 advisory. A set of commands to use the XFS filesystem, including mkfs.xfs. XFS is a high performance journaling filesystem which originated on the SGI IRIX platform. It...

WordPress Ninja Tables plugin <= 5.2.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by theviper17 in WordPress Plugin Ninja Tables versions = 5.2.5...

CVE-2025-12984

The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 2.0.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes i...