9409 matches found
CVE-2026-9410 Sushmi-pal Invoice-System Profile Workflow profile improper authorization
A vulnerability has been found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b. This vulnerability affects unknown code of the file /profile of the component Profile Workflow. Such manipulation of the argument ID leads to improper authorization. It is possible to launc...
CVE-2026-47373
creationtimestamp| type| source ---|---|--- 2026-05-22 22:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmhwoid5co26...
OESA-2026-2360 python-pip security update
%changelog Thu Apr 9 2026 yixiangzhike [email protected] - 23.3.1-10 - Fix CVE-2026-25645 Security Fixes: pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavio...
ECHO-2DA5-FEA1-604D
Bulletin has no description...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: Wifi: ath12k: Handle lock during peerid find The ath12kpeerfindbyid function requires that the caller holds the ab-baselock. Currently, the WBM error path does not hold the lock, and calling that function leads to the following...
Astra Linux – Vulnerability in opensc
A flaw was discovered in OpenSC packages that could allow for a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length PIN is passed. This issue poses a security risk, especially for OS...
MINI-H6PQ-HFVJ-H96Q
Bulletin has no description...
MINI-GFQ6-W36R-F39C
Bulletin has no description...
MINI-M965-97W5-6JGG
Bulletin has no description...
MINI-89PH-WV9C-V45G
Bulletin has no description...
MINI-9XRF-4G6P-4FCJ
Bulletin has no description...
GHSA-QXVM-R42F-5P8J AVideo's Meet plugin: `uploadRecordedVideo.json.php` derives `users_id` from the uploaded filename and calls passwordless `User->login()`, allowing any caller with the Meet shared secret to obtain a session as arbitrary users including admin
Summary Type: Authorization-bypass via user-controlled identifier. The Meet plugin's recorded-video upload endpoint plugin/Meet/uploadRecordedVideo.json.php authenticates the caller using a single shared Authorization: Bearer against $objM-secret. Once that check passes, the endpoint reads the...
ECHO-0ADD-693B-F63C
Bulletin has no description...
BIT-MODSECURITY2-2026-42268 ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators
ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. From 3.0.0 to before 3.0.15, there is an unhandled exception std::outofrange caused by unsigned integer underflow in libmodsecurity3 if the user administrator uses a rule any of @verifySSN...
MINI-3Q5Q-3754-VXQJ
Bulletin has no description...
Identifying AI Web Scrapers Using Canary Tokens
From pre-training to query-time augmentation, web-scraped data helps to improve the quality and contextual relevancy of content generated by large language models LLMs. However, large-scale web scraping to feed LLMs can affect site stability and raise legal, privacy, or ethics concerns. If websit...
PIN bypass in PassCodeActivity via back button
None...
MINI-6CQW-W7J4-2CQM
Bulletin has no description...