EUVD-2026-70320

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

CVE-2026-9853

CVE-2026-9853 is a vulnerability in Hitachi Energy's SYS600 application that allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without completing SYS600's own authentication. This effectively bypasses the intended ac...

CVE-2026-15598

CVE-2026-15598 تم تحديد ثغرة أمنية في antv layout 2.0.0. تؤثر هذه الثغرة على الدالة setNestedValue في المكتبة lib/util/object.js. تنفيذ معالجة على وسيطة المسار path قد يؤدي إلى تعديل غير متحكم فيه لخصائص النموذج الأولي للكائن. يمكن شنّ الهجوم عن بُعد. تم إبلاغ المشروع بالمشكلة مبكرًا عبر تقرير...

pylibemu

Pylibemu |version badge| |downloads badge| .. |version badge| image:: https://img.shields.io/pypi/v/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ .. |downloads badge| image:: https://img.shields.io/pypi/dm/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ Pylibemu is a...

CVE-2026-42406

A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2026-40291

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/id endpoint allows any authenticated user with ROLESTUDENT to escalate their privileges to ROLEADMIN by modifying the roles field o...

EUVD-2026-22772

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/id endpoint allows any authenticated user with ROLESTUDENT to escalate their privileges to ROLEADMIN by modifying the roles field o...

CVE-2026-40291

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/id endpoint allows any authenticated user with ROLESTUDENT to escalate their privileges to ROLEADMIN by modifying the roles field o...

PT-2026-32939

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/id endpoint allows any authenticated user with ROLE STUDENT to escalate their privileges to ROLE ADMIN by modifying the roles field...

Chamilo LMS 安全漏洞

Chamilo LMS is an open-source online learning and collaboration system developed by Chamilo. This system supports the creation of teaching content, remote training, and online quizzes. Versions of Chamilo LMS prior to 2.0.0-RC.3 contained security vulnerabilities. These vulnerabilities stemmed fr...

Prototype Pollution

deepHas is vulnerable to Prototype Pollution. The vulnerability is due to unsafe handling of nested object keys, where attacker-controlled input can modify properties on JavaScript prototypes, allowing global object behavior to be altered in applications using deephas...

Malicious code in fadhil-gaplek76-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 505847476472653535771aa146e73a6935b6a4c1a7498fd22cb45f5ee99007c0 The package fadhil-gaplek76-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

EUVD-2017-14203

Malware in sbrugna...

EUVD-2021-11413

Malware in sbrugna...

EUVD-2021-2018

Malware in sbrugna...

EUVD-2021-29107

Malicious code in bioql PyPI...

EUVD-2022-7394

Malicious code in bioql PyPI...

EUVD-2021-29106

Malicious code in bioql PyPI...

Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users

Impact All objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users. If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations. Attack...

CVE-2021-42121

Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version = 7.1.27 on an object’s date attributes allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads t...