CVE-2019-25766

A flaw was found in Renovate. During certain Go Modules update failure scenarios, temporary repository tokens are inadvertently leaked into pull request comments. A remote attacker able to view these comments could obtain the exposed tokens, leading to unauthorized access to repositories. This...

assertj-core security update

An update is available for assertj-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A rich and intuitive set of strongly-typed assertions to use for unit...

CVE-2026-81672

CVE-2026-81672 is a SQL injection vulnerability in TOOOLS' iSquad , affecting the /ws/apiprensa/getVideoSubcanal endpoint. The root cause is improper handling of the id_video parameter: the application does not sanitize input before constructing SQL queries, leading to execution errors with malic...

EUVD-2026-67005

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...

CVE-2026-81672 Multiple Vulnerabilities in TOOOLS' iSquad

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...

CVE-2026-75838

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CVE-2026-72814

A flaw was found in actix-files. When a non-existing folder is provided as the servefrom argument to Files::new, the service incorrectly resolves request paths as relative to the application's working directory. This allows an attacker to access unintended files, leading to information disclosure...

CVE-2026-73646

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

CVE-2026-80578

A flaw was found in the Linux kernel's fbdev core. A local user could trigger an out-of-bounds read vulnerability in the fbioread function. This occurs due to a pointer desynchronization when handling partial copies from a faulty user buffer, allowing the system to read beyond intended memory...

CVE-2026-19632

كشف رابط إعادة تعيين كلمة المرور في TranslatePress إلى الاستيلاء الكامل على حساب المسؤول CVE: CVE-2026-19632 | CVSS: 9.8 حرج استيلاء غير مصادق عليه على الحساب عبر إضافة TranslatePress لووردبريس. الوقت من نشر CVE إلى PoC يعمل في اليوم الأول: 5 ساعات، 9 دقائق، 40 ثانية حتى الإصدار 3.3.1 وما قبله؛ ت...

CVE-2026-81658

Foreman is affected by an authorization flaw in its template revision endpoint , which does not enforce object-level authorization when retrieving audited template revisions. An authenticated, low-privileged user with a template-related permission (e.g., view_ptables) can retrieve historical temp...

CVE-2026-81658 Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-81658

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as viewptables, can obtain historical template contents belonging to...

CVE-2026-80550

A flaw was found in the s390/vfioccw component of the Linux kernel. The ccwchaincalclength routine, which counts channel command words CCWs, incorrectly checked array boundaries. This could lead to an out-of-bounds read, where the system attempts to access memory beyond its allocated limits. Such...

cve-2025-33073

नमस्ते! मैं एक AI हूँ! शांत रहें! यह सिर्फ एक मजाक है, वास्तव में मैं AI नहीं हूँ, यह मेरे शहर के मेट्रो की उद्घोषिका का मजाक उड़ाना है जो AI जैसी लगती है। कुछ लोग ऐसे भी होते हैं जो AI जैसा व्यवहार करते हैं: अच्छे, मुस्कुराते हुए, सभी सामाजिक मानकों का पालन करने वाले, लेकिन अंदर से आप कुछ सतही औ...

CVE-2026-35678

Rapporto di Ricerca sulle Vulnerabilità: Insecure Direct Object Reference IDOR Universale in Eduplus Student ERP Ricercatore: Vinay Sharma 1. Sintesi Esecutiva Questo rapporto descrive una vulnerabilità di sicurezza ad alta gravità identificata nella piattaforma Eduplus Student ERP, in particolar...

CVE-2025-62168

CVE-2025-62168 Divulgazione di informazioni nel proxy Squid nella gestione degli errori Scanner Rilevamento e PoC "A causa di una mancata oscuramento delle credenziali di autenticazione HTTP Squid è vulnerabile a un attacco di divulgazione di informazioni. Gravità: Questo problema consente a uno...

CVE-2026-80543

A flaw was found in the Linux kernel's s390/zcrypt component. When copying user-space messages into a kernel buffer, the system fails to properly pad the message to a 4-byte length. This oversight can lead to up to three bytes of uninitialized kernel memory being exposed to the crypto card...

CVE-2023-51127

CVE-2023-51127 Le telecamere termiche FLIR AX8 fino alla versione 1.46.16 inclusa sono vulnerabili a Directory Traversal a causa di una restrizione di accesso impropria. Questa vulnerabilità consente a un attaccante remoto non autenticato di ottenere contenuti arbitrari di file sensibili caricand...

CVE-2026-65915

A flaw was found in NLTK. A logic bug in the FileSystemPathPointer.open function allows the sandbox validation check to be bypassed. A remote attacker can exploit this by providing specially crafted file:// Uniform Resource Locators URLs to nltk.data.load. This enables the attacker to read...