GHSA-GHVF-QF6H-G8X5 NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution The first vulnerability allows any authenticated admin to redirect the file upload storage root to an arbitrary path on disk including the application directory itself by supplying an...

Exploit for CVE-2026-18366

CVE-2026-18366 — Events Manager 7.4.1: Unauthenticated Pr...

CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

UBUNTU-CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-63037

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

EUVD-2026-63477

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63042

Apache InLong (versions 2.0.0 through 2.3.x) is vulnerable to a flaw where any authenticated manager user can create, modify, or delete Data Node definitions . This missing authorization on management endpoints can lead to files or directories becoming accessible to external parties. To remediate...

CVE-2026-63037

An unauthenticated SQL injection vulnerability exists in the Apache InLong Manager backend database, specifically affecting versions 2.0.0 through 2.3.x . The root cause is the improper neutralization of special elements used in an SQL command within the ORDER BY clause of the Manager OpenAPI aud...

EUVD-2026-63398

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

CVE-2026-63037 Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgra...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.5.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...

Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM Guardium Key Lifecycle Manager (GKLM)

Summary WebSphere Application Server and WebSphere Application Server Liberty is shipped as a component of IBM Guardium Key Lifecycle Manager GKLM. Information about security vulnerabilities affecting WebSphere Application Server and WebSphere Application Server Liberty has been published in a...

Azure Data Manager for Energy Remote Code Execution Vulnerability

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

IDS Deployment & Packet Analysis Network intrusion detectio...

WordPress Vitepos Lite plugin < 3.5.0 - Outlet Manager+ Privilege Escalation vulnerability

Outlet Manager+ Privilege Escalation vulnerability discovered by RealKingEngine ISAL FRAMEWORK in WordPress Plugin Vitepos versions 3.6.0...

WordPress Vitepos plugin < 3.6.0 - Outlet Manager+ Privilege Escalation vulnerability

Outlet Manager+ Privilege Escalation vulnerability discovered by RealKingEngine ISAL FRAMEWORK in WordPress Plugin Vitepos versions 3.6.0...

WordPress WP Events Manager plugin < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter vulnerability

Subscriber+ Payment Bypass via 'qty' Parameter vulnerability discovered by Mustafa Ahmed in WordPress Plugin WP Events Manager versions 2.2.5...

Johnson Controls Simplex Incident Manager

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials passwords and authentication tokens from system memory, potentially leading to unauthorized access to the application and connected systems. 2. RECOMMENDED...