PT-2026-117466

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

PT-2026-117402

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit h...

PT-2026-117332

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description A path traversal issue exists in the Apache Camel Mina SFTP component. Remote-file consumers build absolute remote paths by concatenating a...

CVE-2025-60482

A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2026-111045: Improper Link Resolution Before File Access

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

Resilient File System Code Execution

The vulnerability of the Resilient File System ReFS in Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

EUVD-2025-211130

A segmentation violation in the dumpisomsaps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

ROS-20261019-73-0037

The vulnerability of the go-git library is related to a countable amount of significance loss. Exploiting this vulnerability can allow an attacker to cause a service failure by using a specially created malicious .idx file...

ROS-20261019-73-0004

The vulnerability of the ffhevcputhevcqpelh3v3sse function in the h.265 Libde265 implementation is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure through the use of a specially...

CVE-2025-52290

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

PT-2026-117236

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

ROS-20261019-73-0001

The vulnerability of the ffhevcputhevcepelpixels8sse function in the h.265 Libde265 implementation is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created video file...

EUVD-2025-211132

A NULL pointer dereference in the avprivh264hasnumreorderframes function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

PT-2026-117533

A NULL pointer dereference in the avpriv h264 has num reorder frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service DoS via processing a crafted media file...

RHEL 9 : gegl04 (RHSA-2026:84575)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:84575 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...

Linux Distros Unpatched Vulnerability : CVE-2026-112282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint that allows attackers to crash applications by supplying a...

RHEL 9 : gegl04 (RHSA-2026:85253)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:85253 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...

CVE-2026-111935: External Control of File Name or Path

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

ALSA-2026:84595 Moderate: cockpit-files security update

A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...

CVE-2026-85250: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...