CVE-2026-72565

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

CVE-2026-72565

Tencent APIJSON (up to 8.1.8) contains a SQL injection in the Map-form @having operator that bypasses per-table access control, enabling unauthenticated remote attackers to read arbitrary database tables. The APIJSONORM AbstractSQLConfig.java applies per-role allow-list checks only to the String ...

CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

CVE-2026-66403

Affected products: ECOVACS DEEBOT PRO M1 and DEEBOT PRO K1VAC. The issue (CVE-2026-66403) is that a web server for debugging remains enabled, potentially allowing retrieval of stored floor maps and logs. Root cause per JVNDB entry is the debugging web server left active; no exploit details are pr...

PT-2026-69554

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the libceph component where the crush decode function fails to reject zero bucket types. Since CRUSH bucket type 0 is reserved for devices, a malformed CRUSH map can...

CVE-2026-68157: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-68158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: Fix multiplication overflow in decodenewupstateweight If a message of type CEPHMSGOSDMAP contains a maliciously corrupted osdmap, out-of-bounds memory...

PT-2026-69557

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in libceph where localized read selection can process a parent bucket that has a name in the CRUSH map but lacks a corresponding entry in type names. This leads to the ge...

CVE-2026-68157: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in typenames. getimmediateparent then dereferences a NULL...

Linux Distros Unpatched Vulnerability : CVE-2026-68157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent...

CVE-2026-72565: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

CVE-2026-16988

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

EUVD-2026-54890

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

CVE-2026-16988: Exposure of Sensitive Information to an Unauthorized Actor

The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public pending or draft listings...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

EulerOS 2.0 SP11 : xorg-x11-server (EulerOS-SA-2026-3164)

According to the versions of the xorg-x11-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows ...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-3123)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encod...

dnsglobe v0.5.0

dnsglobe A global DNS propagation checker for your terminal — a Rust TUI that queries 34 public DNS resolvers around the world in parallel, compares their answers, and shows the propagation of your record on a world map. Think dnschecker.org / whatsmydns.net, but in your terminal, with watch mode...