CVE-2026-96772: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-56096

CVE-2026-56096: Inyección de consultas en Solr y extracción ciega de datos en TYPO3 EXT:solr Se descubrió una vulnerabilidad de seguridad arquitectónica en la extensión oficial de Apache Solr para TYPO3 EXT:solr / apache-solr-for-typo3/solr. El problema permite a atacantes remotos no autenticados...

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

CVE-2026-92770

Harbor through 2.15.2 is affected by a scanner credential disclosure vulnerability. The root cause is an improper restriction on the q query parameter used for filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column t...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-15439: Improper Neutralization of Special Elements used in an SQL Command

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...

CVE-2026-85207: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-80628: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Serialize readq reset state with q-lock sndseqossreadqclear resets qlen, head, and tail without q-lock even though the normal reader and producer paths serialize the same ring state under that spinlock. A reset ca...

BIT-DISCOURSE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

CVE-2026-49222

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-49222 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-53960 Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A QAPage JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engi...

GO-2024-2682 vulnerabilities

Vulnerabilities for packages: caddy, cloudflared, k3s, q, caddy-fips...

GO-2025-4017 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, kargo, q, kyverno-policy-reporter-ui, spegel, ipfs-cluster, caddy, dkron, frp, traefik, k3s, k8sgateway, kubo...

GO-2024-2682 vulnerabilities

Vulnerabilities for packages: caddy, k3s, q, cloudflared...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: buf, kubernetes-dns-node-cache, kargo, seaweedfs, q, spegel, ipfs-cluster, caddy, dkron, frp, traefik, k3s, k8sgateway, kubo...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: nri-couchbase, guac, neuvector-scanner, litefs, opentofu, crossplane-provider-aws-rds, azcopy, rancher-fleet, vault-benchmark, apisix-ingress-controller, nri-kubernetes, tekton-chains, act, cluster-autoscaler, docker-machine-driver-linode, step-issuer, db-operator,...