CVE-2026-33084 DataEase has SQL Injection through its getFieldEnumObj Endpoint

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service layer directly transfers the user-supplied sort value to the...

CVE-2026-33084

DataEase (open-source) has a SQL injection in versions ≤ 2.10.20 via the sort parameter of the /de2api/datasetData/enumValueObj endpoint. The DatasetDataManage service passes the user-supplied sort value to the sorting metadata DTO, which is then incorporated into the SQL ORDER BY clause in Order...

Cross-site Request Forgery

RedwoodSDK is vulnerable to Cross-site Request Forgery. The vulnerability is due to server functions exported from 'use server' files being invoked via GET requests, bypassing their intended HTTP method, where browsers send SameSite=Lax cookies on top-level GET requests and an attacker could...

free5GC 安全漏洞

free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of free5GC prior to 4.2.1 contained security vulnerabilities. These vulnerabilities stemmed from the GET request handler not properly returning values when necessary parameters were missing. This allowed the...

PT-2026-34725

Name of the Vulnerable Software and Affected Versions Mako versions prior to 1.3.11 Description Mako is a template library written in Python. The get template function within TemplateLookup is susceptible to path traversal when a URI begins with //. This occurs due to an inconsistency between two...

The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system allows a perpetrator to execute arbitrary code.

The vulnerability of the JRPC application interface of the FortiSandbox threat detection and mitigation system is related to the failure to eliminate special elements “|” when processing the jid parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending...

CVE-2024-8010: Improper Restriction of XML External Entity Reference

The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:1365-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:1365-1 advisory. - CVE-2026-3479: improper resource argument validation in pkgutil.getdata can allow path traversal bsc1259989. Tenable has extracted the preceding...

tomcat: security constraint bypass with HTTP/0.9

A flaw was found in Tomcat. An improper input validation vulnerability allows an attacker to bypass security constraints. Specifically, if a security constraint is configured to permit HEAD requests to a URI but deny GET requests, a malformed or specification invalid HEAD request using the HTTP/0...

Security update for python

This update for python fixes the following issues: CVE-2026-3479: improper resource argument validation in pkgutil.getdata can allow path traversal bsc1259989. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:1365-1 Security update for python

This update for python fixes the following issues: - CVE-2026-3479: improper resource argument validation in pkgutil.getdata can allow path traversal bsc1259989...

Missing Authorization in get_deployed_stack Endpoint Allows Cross-Tenant Stack Enumeration via Server-Side Client Bypass

Description The GET /api/v1/stack-deployment/stack endpoint getdeployedstack is missing all RBAC authorization checks, while its sibling endpoint getstackdeploymentconfig in the same file has three verifypermission calls. This allows any authenticated user to enumerate all deployed stacks across...

CVE-2026-30996

An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request...

The vulnerability of D-Link DI-8003 router microprogramming software, related to buffer overflow in the stack, allows a hacker to trigger a service failure.

The vulnerability of D-Link DI-8003 router’s microprogramming software is related to buffer overflow in the stack when processing the customerror parameter. Exploiting this vulnerability allows an attacker to cause a service failure by sending a specially crafted GET request to the /user.asp...

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of the input data. This allows a hacker to trigger a service failure.

The vulnerability of D-Link DI-8003 router’s microprogramming software lies in the copying of buffers without checking the size of input data when processing the id parameter. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a specially crafted GET...

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of the input data. This allows a hacker to trigger a service failure.

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a specially crafted GET request to the final destination...

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of the input data. This allows a hacker to trigger a service failure.

The vulnerability of D-Link DI-8003 router’s microprogramming software lies in the copying of buffers without checking the size of input data when processing the s parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a specially crafted GET request...

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of the input data. This allows a hacker to trigger a service failure.

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of input data during the processing of the routes parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a specially crafted...

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of the input data. This allows a hacker to trigger a service failure.

The vulnerability of D-Link DI-8003 router microprogramming software lies in the copying of buffers without checking the size of input data during the processing of the vlanname parameter. Exploiting this vulnerability allows an attacker, operating remotely, to cause a service failure by sending ...

CVE-2026-30996: Improper Limitation of a Pathname to a Restricted Directory

An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request...