RLSA-2026:67613 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

CVE-2025-50565

CVE-2025-50565 Description Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. Vulnerability Type SQL Injection Attack Type Remote Impact Information Disclosure true Has vendor confirmed true Discoverer...

CVE-2026-36438

CVE-2026-36438: Sensitive information via password reset The Intelbras VIP 1230 B/D G4 versions prior to 6 allows a remote attacker to obtain sensitive information of administrator account via password reset functionality under OutsideCmd file. Discovered by Henrique Koji, Feb 2026. References:...

CVE-2026-36374

Description A public endpoint has been identified that allows certificate lookup using a predictable identifier certificate code, without any authentication or authorization mechanism. By enumerating this identifier, an attacker can access third-party personal data, including full name, CPF...

CVE-2025-11174

CVE-2025-11174: Unauthenticated Information Disclosure in Document Library Lite WordPress Plugin Keywords: CVE-2025-11174, Document Library Lite vulnerability, information disclosure, WordPress security, unauthenticated AJAX exploit, WordPress plugin vulnerability, CWE-862, WordPress document...

CVE-2026-87028

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

EUVD-2026-80894

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

CVE-2026-18120 Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries permission check applied by the normal dashboard and CSV Export flow. An unauthenticated visitor who knew or discovered an Express entity identifier...

CVE-2026-3288-lab

CVE-2026-3288 Vulnerable Lab Docker NGINX Ingress Controller Configuration Injection ⚠️ WARNING : This lab contains intentionally vulnerable configurations for AUTHORIZED SECURITY TRAINING ONLY Vulnerability Overview CVE-2026-3288 CVSS 8.8 HIGH - Configuration injection in NGINX Ingress Controller...

CVE-2026-64753

A flaw was found in WebKitGTK. Processing malicious web content can disclose sensitive user information due to a permissions issue. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2026-87028

CVE-2026-87028 is a cross-board Insecure Direct Object Reference (IDOR) in the Board Custom Slot Preview endpoint of Concrete CMS 9.0.0 through 9.5.3 . The endpoint failed to verify that a submitted InstanceItem belonged to the board instance the requesting user was authorized to edit, and did no...

EUVD-2026-80881

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an...

PoC-CVE-2026-21858

PoC-CVE-2026-21858 n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remo...

CVE-2026-40776

CVE-2026-40776 Eventin wp-event-solution Broken Access Control Unauthenticated PII disclosure and order forgery in the Eventin WordPress plugin 10,000+ active installs. A public REST endpoint hands out a wprest nonce to any visitor, and three downstream permission callbacks accept that nonce as a...

CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - User Information Disclosure This repo contains a Proof of ConceptPoC exploit for CVE-2026-53959 Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permissio...

dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network...

Important: Red Hat Security Advisory: .NET 9.0 security, bug fix, and enhancement update

An update for .NET 9.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2026-61595

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...

ktor-xxe

ktor-xxe Run the project with : | ./gradlew run | Run the server | If the server starts successfully, you'll see the following output: root@kitploit: 2024-12-04 14:32:45.584 main INFO Application - Application started in 0.303 seconds. 2024-12-04 14:32:45.682 main INFO Application - Responding at...