CVE-2026-88402

A SQL injection vulnerability exists in the checkSQL function of nocobase v2.1.21 . This flaw allows an attacker to inject crafted SQL statements to access sensitive database information . The vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.8, indicating a high impact on confidentia...

ROS-20260921-73-0098

The vulnerability of the ReadBlock function in the SquashFS file compressor and 7-Zip archive creator relates to reading data outside of the allowed range in memory. Exploiting this vulnerability could allow a malicious actor to disclose confidential information...

ROS-20260921-73-0036

The vulnerability in curl is related to the disclosure of information during data transmission. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

SUSE SLES15: libwireshark15 / libwiretap12 / libwsutil13 / wireshark / etc (SUSE-SU-2026:4077-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4077-1 advisory. - CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops bsc1271133. - CVE-2026-15164: Denial of Service...

MiracleLinux 9 : tomcat-9.0.120-2.el9_8 (AXSA:2026-1883:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1883:07 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat:...

CVE-2026-82165: Incorrect Default Permissions

Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

VulnCheck KEV: CVE-2018-13980

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal...

ALSA-2026:69126 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

ALSA-2026:69113 Moderate: apr-util security update

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more. Security Fixes: apr-util: Apache Portable Runtime...

CVE-2026-55563: Incorrect Authorization

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55060: Incorrect Authorization

GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/processlist endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line...

SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2026:4003-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4003-1 advisory. - CVE-2026-59184: invalid heap pointer, causing out-of-bounds or use-after-free writes bsc1276849. -...

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware and django.views.decorators.cache.cache_page modules in the Django web application framework allows attackers to disclose sensitive information.

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware and django.views.decorators.cache.cachepage modules in the Django web development framework relates to the disclosure of information through caching. Exploiting this vulnerability could allow an attacker to disclose sensitive...

The vulnerability of the django.contrib.gis.gdal.GDALRaster module in the Django web application framework allows a attacker to disclose protected information or cause service failures.

The vulnerability of the django.contrib.gis.gdal.GDALRaster module in the Django web application framework is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to disclose sensitive information or cause service...

The vulnerability of the `storagePoolVolumesPost()` function in the `cmd/incusd/storage_volumes.go` file of the container management system and the Incus virtual machine manager, which allows a attacker to disclose protected information.

The vulnerability of the storagePoolVolumesPost function in the cmd/incusd/storagevolumes.go file of the container management system and the Incus virtual machine manager is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to disclose sensitive...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the failure to take measures to clean data at the management level, allows a perpetrator to gain unauthorized access to protected information or execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken at the management level to clean data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information or execu...

Debian dsa-6508 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6508 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6508-1 [email protected] https://www.debian.org/securit...

RHEL 9 : osbuild-composer (RHSA-2026:69293)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69293 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...

ALSA-2026:69461 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component CVE-2026-92024 firefox: thunderbird: Mitigation bypass in the Remote Settings Client component CVE-2026-92019...