22684 matches found
MINI-FVJG-5G5P-4HW9
Bulletin has no description...
CVE-2026-40482 ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`
ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString via unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0...
CVE-2026-40482 ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`
ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString via unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0...
CVE-2026-6364
Out of bounds read in Skia in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted file. Chromium security severity: Medium...
MINI-56V4-3JV3-GV27
Bulletin has no description...
CVE-2026-5088 Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts
Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts. The makesalt and makesaltbcrypt methods will attept to load Crypt::URandom and then Bytes::Random::Secure to generate random bytes for the salt. If those modules are unavailable, it will simply...
CVE-2026-33808
creationtimestamp| type| source ---|---|--- 2026-04-15 01:50:08+00:00| published-proof-of-concept| https://github.com/fastify/fastify-express/security/advisories/GHSA-6hw5-45gm-fj88 2026-04-15 09:37:06+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjjlupakwk2c 2026-04-15...
CVE-2026-26151
creationtimestamp| type| source ---|---|--- 2026-04-14 15:49:19+00:00| seen| https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review 2026-04-14 20:04:25+00:00| seen| Telegram/hD8BjHqo43Qf6oIWK9i1JRdC3nHW3FaftBe01IuiLhYdcFI 2026-04-15 06:53:38+00:00| seen|...
Exploit for CVE-2026-40175
No d...
CVE-2026-31418
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: drop logically empty buckets in mtypedel mtypedel counts empty slots below n-pos in k, but it only drops the bucket when both n-pos and k are zero. This misses buckets whose live entries have all been removed...
Craft Commerce has an unauthenticated information disclosure that can leak some customer order data on anonymous payments
Summary PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON error response includes the serialized order object order, which contains some sensitive fields such as custome...
CVE-2026-32270
Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses some order data to unauthenticated users when an order number is provided and the email check fails during an anonymous payment. The JSON...
CVE-2026-39479
creationtimestamp| type| source ---|---|--- 2026-04-13 19:18:48+00:00| published-proof-of-concept| Telegram/faPFXRAaRfhi9SNZmtwnWuzO2c0g7l8werKC93MLkaum65E...
CVE-2026-34861
creationtimestamp| type| source ---|---|--- 2026-04-13 07:17:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjed4rvgs62t...
PT-2026-32511
Name of the Vulnerable Software and Affected Versions Craft Commerce versions prior to 4.11.0 Craft Commerce versions prior to 5.6.0 Description The actionPay function in the 'PaymentsController' discloses order data to unauthenticated users. This occurs when an order number is provided and the...
Ubuntu: Security Advisory (USN-8163-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2026-6118
creationtimestamp| type| source ---|---|--- 2026-04-12 06:55:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjbrghufuw2z 2026-04-12 17:43:58+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-6118.yaml 2026-04-15...
MINI-XWWJ-MH38-8497
Bulletin has no description...