Pterodactyl Panel - Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. id: CVE-2025-49132 info: name: Pterodactyl Panel - Remote Code Execution...

Extensions Component Protected Information Access

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

Navigation Component Google Chrome Microsoft Edge Protected Information

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge is related to insufficient validation of entered protected information. Exploiting this vulnerability can allow a malicious actor to gain access to protected information through a specially created HTML page...

TabGroups Component Google Chrome Microsoft Edge Information Disclosure

The vulnerability of the TabGroups component in Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information remotely...

Transactions Platform XSS

The vulnerability of the Transactions Platform web browsers Google Chrome and Microsoft Edge is related to improper authentication. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...

CVE-2024-34323

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference IDOR via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request...

CVE-2024-34323

ProPhoenix Law RMS v2022.2403.3.101 is vulnerable to an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This flaw allows an attacker to perform a crafted HTTP request to gain unauthorized access to sensitive information . The vulnerability is associated with CWE-639 (A...

CVE-2024-34323: Authorization Bypass Through User-Controlled Key

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference IDOR via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request...

PT-2026-111129

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description A Cross-Site Scripting XSS flaw allows an attacker to store malicious content that the application later renders. When an authenticated user accesses a...

CVE-2026-21134

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information...

CVE-2026-88424: Improper Neutralization of Special Elements used in an SQL Command

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

CVE-2026-88424

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_18097)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202518097 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43272 webkitgtk: Processing maliciously crafted web...

Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_20922)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202520922 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43272 webkitgtk: Processing maliciously crafted web...

Rocky Linux 8 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_17802)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202517802 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2025-43272 webkitgtk: Processing maliciously crafted web...

Anjvision YSSD-RTMP-H5

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the...

CVE-2026-84893 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database...

ROS-20260925-73-0011

The vulnerability of the tuningctlset function in the sound subsystem of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to access protected information or cause service failures...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-88402: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...