MiracleLinux 4 : rh-mariadb101-mariadb-10.1.19-6.AXS4 (AXSA:2017-1288:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1288:01 advisory. MariaDB is a community developed branch of MySQL. MariaDB is a multi-user, multi-threaded SQL database server. It is a client/server implementation...

CVE-2021-47819 ProjeQtOr Project Management 9.1.4 - Remote Code Execution

ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution capabilities. Attackers can upload a PHP script through the profile attachment section and execute system commands by accessing the uploaded...

WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Denver Jackson in WordPress Plugin g-FFL Checkout versions = 2.1.0...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002044)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002044 advisory. arch/arm64/kernel/perfevent.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service invalid pointer...

Adobe Substance 3D Sampler <= 5.1.0 Out-of-bounds Write (APSB26-11)

The version of Adobe Substance 3D Sampler installed on the remote host is prior or equal to 5.1.0 It is, therefore, affected by a out-of-bounds write vulnerability as referenced in the APSB26-11 advisory. - Substance3D - Sampler versions 5.1.0 and earlier are affected by an out-of-bounds write...

EUVD-2026-2434

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting XSS vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in...

CVE-2025-71166

CVE-2025-71166 affects Typesetter CMS versions up to and including 5.1. The vulnerability is a reflected cross-site scripting (XSS) in the administrative interface, specifically in the Tools Status move message handling. The path parameter is reflected into HTML output without proper encoding in ...

CVE-2025-71165

Summary: Typesetter CMS

CVE-2025-13627 Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting

The Makesweat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'makesweatclubid' setting in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level acce...

CVE-2026-22612

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7...

CVE-2025-8090

Null pointer dereference in the MsgRegisterEvent system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino kernel...

Astra Linux – Vulnerability in imagemagick

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, the WriteSVGImage function contained a vulnerability where using an integer variable to store numberattributes could lead to integer overflow. This, in turn, triggered a buffe...

WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Laurent versions = 3.1...

PT-2026-2398

Name of the Vulnerable Software and Affected Versions Audio Conversion Wizard version 2.01 Description Audio Conversion Wizard version 2.01 contains a buffer overflow issue. An attacker can execute arbitrary code by providing a specially crafted registration code that overwrites memory. This can...

PT-2026-3523

Name of the Vulnerable Software and Affected Versions jaraco.context versions prior to 6.1.0 Description jaraco.context, a software package providing decorators and context managers, contains a path traversal issue in the jaraco.context.tarball function. The issue allows attackers to extract file...

PHPGurukul News Portal Project 安全漏洞

PHPGurukul News Portal Project is a news portal project by PHPGurukul Inc. A security vulnerability exists in PHPGurukul News Portal Project version V4.1, which stems from a file upload vulnerability in the upload.php file, which could lead to arbitrary file uploads...

CVE-2025-69991

phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in checkavailablity.php...

CVE-2026-22784 Lychee cross-album password propagation on Album unlocking

Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected...

CVE-2025-68657

Espressif ESP-IDF USB Host HID Human Interface Device Driver allows access to HID devices. Prior to 1.1.0, calls to hidhostdeviceclose can free the same usbtransfert twice. The USB event callback and user code share the hidifacet state without locking, so both can tear down a READY interface...

CVE-2025-68657 espressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close Path

Espressif ESP-IDF USB Host HID Human Interface Device Driver allows access to HID devices. Prior to 1.1.0, calls to hidhostdeviceclose can free the same usbtransfert twice. The USB event callback and user code share the hidifacet state without locking, so both can tear down a READY interface...