MINI-MCWM-R84M-MVWM

Bulletin has no description...

WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Golo Framework versions 1.7.5...

Vulnerabilities found in Oracle Financial Services

Oracle has identified vulnerabilities in various Financial Services Enterprise modules. These vulnerabilities exist in third-party products such as Apache Kafka, Log4j, and the Spring Framework. Updates have been released by the developers for these products. These updates are now integrated into...

Vulnerabilities in Oracle Database Products

Oracle has identified vulnerabilities in various database products, including the Database Server, Essbase, Autonomous Health Framework, and Oracle Application Testing Suite. The Oracle Database Server versions 19.3 to 23.26.3 contains critical vulnerabilities in the RDBMS and Portable Clusterwar...

CVE-2026-76164

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

EUVD-2026-62366

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

CVE-2026-76164 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

CVE-2026-76164

CVE-2026-76164 is a non-blind SSRF in the AIL Framework crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling without adequate destination validation. Manual crawler tasks bypass the existing domain blacklist (assigned non-zero priority), and...

CVE-2026-76164 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

BIT-MONGODB-2026-13076 Aggregation Framework Memory Exhaustion Leading to Process Termination

An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...

RLSA-2026:56521 Important: gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fixes: gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI...

Billion 5200W-T - Remote Command Injection

Unauthenticated or authenticated OS command injection in Billion 5200W-T via advremotelog.asp or toolstime.asp. Spawns utelnetd and opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 5200W-T remote command injection — opens framework shell session.""" from...

CVE-2026-76164: Server-Side Request Forgery (SSRF)

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

PT-2026-78322

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

PT-2026-78649

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

CVE-2026-48024: Improper Limitation of a Pathname to a Restricted Directory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...

PT-2026-79970

An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and...

CVE-2026-46343: Improper Limitation of a Pathname to a Restricted Directory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.endreceivingfile in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUHPATH. A syniwme request wi...

CVE-2026-41424: Incorrect Authorization

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2026-44901: Deserialization of Untrusted Data

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge in framework/wazuh/core/results.py trusts the sortcasting field in a cluster worker's JSON response. During a distributed API merge...