IBM Data Risk Manager - Authentication Bypass via SAML

IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the...

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

IBM Operational Decision Manager - JNDI Injection

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145. id: CVE-2024-22319 info: name: IBM Operational Decision Manager -...

Micro Focus UCMDB - Remote Code Execution

Micro Focus UCMDB is susceptible to remote code execution. Impacted products include Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions, and Operations Bridge containerized 2020.05, 2019.08, 2019.0...

IBM Operational Decision Manager - Java Deserialization

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, and 8.12.0.1 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to...

CVE-2026-37064

CVE-2026-37064 Enumeración de usuarios en /vfm-admin/ajax/usr-check.php en Veno File Manager Project 4.4.9 permite a un atacante no autenticado enumerar los usuarios de la aplicación mediante el envío de una solicitud POST especialmente diseñada al endpoint afectado con un parámetro 'username'...

CVE-2026-77991

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-77991 CVE-2026-77991 JEM - Joomla Event Manager 5.0.0 - joomlaeventmanager.net I am @abraxasnull. Loopback lab. The client is CVE-2026-77991-Abraxas-Labs.py. The advisory named a model. Privileged RCE:...

[SECURITY] Fedora 45 Update: zypper-1.14.94-3.fc45

Zypper is a command line package manager tool using libzypp, which can be used to manage software for RPM based systems...

[SECURITY] Fedora 45 Update: pragha-1.3.3-36.fc45

Pragha is is a lightweight GTK+ music manager that aims to be fast, bloat-fre e, and light on memory consumption. It is written completely in C and GTK+. Pragha is a fork of Consonance Music Manager, discontinued by the original author...

[SECURITY] Fedora 45 Update: pacemaker-3.0.3-2.fc45

Pacemaker is an advanced, scalable High-Availability cluster resource manager. It supports more than 16 node clusters with significant capabilities for managing resources and dependencies. It will run scripts at initialization, when machines go up or down, when related resources fail and can be...

[SECURITY] Fedora 45 Update: openbox-3.6.1-32.fc45

Openbox is a window manager designed explicity for standards-compliance and speed. It is fast, lightweight, and heavily configurable using XML for its configuration data. It has many features that make it unique among window managers: window resistance, chainable key bindings, customizable mouse...

[SECURITY] Fedora 45 Update: compiz-0.8.18-22.fc45

Compiz is one of the first OpenGL-accelerated compositing window managers for the X Window System. The integration allows it to perform compositing effects in window management, such as a minimization effect and a cube work space. Compiz is an OpenGL compositing manager that use Compiz use...

[SECURITY] Fedora 45 Update: caja-1.28.0-13.fc45

Caja mate-file-manager is the file manager and graphical shell for the MATE desktop, that makes it easy to manage your files and the rest of your system. It allows to browse directories on local and remote file systems, preview files and launch applications associated with them. It is also...

Security Bulletin: Multiple vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were found in linux kernel, libssh expat, libssh, openSSL in Platform System Manager PSM OS Image for Red Hat Enterprise Linux v8 shipped with IBM Cloud Pak System. Those vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details...

CVE-2026-18443: Improper Neutralization of Special Elements used in an SQL Command

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'accessprivileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

FreePBX-CVE-2025-57819-CVE-2025-61678

FreePBX-CVE-2025-57819-CVE-2025-61678 利用 CVE-2025-57819（堆叠查询 SQL 注入）和 CVE-2025-61678（FreePBX Endpoint Manager 中的认证文件上传）实现远程代码执行 RCE。仅用于教育目的。 参考： https://www.picussecurity.com/resource/blog/critical-freepbx-vulnerabilities-cve-2025-66039-cve-2025-61675-cve-2025-61675...

Pwdb-Public

PWDB - Nueva generación de análisis masivo de contraseñas Objetivo Dejando atrás las cosas de hace 20 años del red team. Las cosas funcionan bien, y nadie se molesta en revisarlas/reemplazarlas durante décadas. Dumps incluidos Puedes consultar el archivo status.txt en este repositorio para hacer...

CVE-2026-37070

CVE-2026-37070 Control de acceso incorrecto en /vfm-admin/ajax/streamvid.php en Veno File Manager Project versión 4.4.9 permite a un atacante autenticado leer cualquier archivo subido por otros usuarios siempre que conozca la ruta y el nombre del archivo mediante una solicitud GET especialmente...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: kube-arangodb, xeol, cluster-api-helm-controller, helm-push, manifest-tool, gitness, opentofu, kyverno-notation-aws, flux-helm-controller, tigera-operator, maru, k9s, helm-mapkubeapis, rancher-helm, helm-set-status, k8sgpt, kargo, cert-manager-cmctl...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: kube-arangodb, xeol, cluster-api-helm-controller, helm-push, manifest-tool, gitness, opentofu, kyverno-notation-aws, flux-helm-controller, tigera-operator, maru, k9s, helm-mapkubeapis, rancher-helm, helm-set-status, k8sgpt, kargo, cert-manager-cmctl...