mysql: DDL unspecified vulnerability (CPU Jan 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access v...

EUVD-2026-14740

Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges...

EUVD-2026-14732

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap, the server prematurely parses and stores this content to...

CVE-2026-4639

Vitals ESP developed by Galaxy Software Services has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to perform certain administrative functions, thereby escalating privileges...

CVE-2026-4640

Vitals ESP developed by Galaxy Software Services has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to execute certain functions to obtain sensitive information...

CVE-2026-4640

The CVE-2026-4640 entry concerns Vitals ESP from Galaxy Software Services, identified in multiple sources (NVD/NIST and CVE List) as a Missing Authentication vulnerability. Unauthenticated remote attackers can access certain functions to obtain sensitive information. Public metrics from TWCERT in...

CVE-2026-4639

CVE-2026-4639 affects Vitals ESP by Galaxy Software Services. The vulnerability is described as Incorrect Authorization, enabling authenticated remote attackers to perform administrative functions and escalate privileges. The NVD/NVD-derived entries provide CVSS 4.0/3.1 values with HIGH severity ...

CVE-2026-3260

Removed by vendor...

UBUNTU-CVE-2026-33250

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player'...

CODESYS Control runtime system 安全漏洞

CODESYS Control runtime system is a control system runtime software developed by the German company CODESYS. It enables the execution of control logic for industrial automation devices. There is a security vulnerability in CODESYS Control runtime system. This vulnerability arises from the...

Galaxy Software Services Vitals ESP 访问控制错误漏洞

Galaxy Software Services Vitals ESP is an office knowledge management system developed by Galaxy Software Services. There is an access control vulnerability in Galaxy Software Services Vitals ESP, which stems from a lack of authentication. This vulnerability may allow unauthorized remote attacker...

IBM i DoS

The vulnerability of the IBM i operating system is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures...

IBM Planning Analytics Local Information Disclosure

The vulnerability of the IBM Planning Analytics Local software relates to the disclosure of information through caching. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2025-60946

Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha...

CVE-2026-32852

MailEnable versions prior to 10.55 contain a reflected cross-site scripting vulnerability in the webmail interface that allows remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Attackers can inject malicious code through the StartDate parameter in...

CSPro Users CSWeb 安全漏洞

CSPro Users CSWeb is a web application developed by CSPro Users Inc. It allows users to securely transfer cases or files between client devices and web servers. Version 8.0.1 of CSPro Users CSWeb contains a security vulnerability that stems from allowing arbitrary file path inputs. This...

Urllib3 HTTP Library DoS

The vulnerability of the HTTP library Urllib3 in the Python programming language is related to incorrect processing of highly compressed input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Django Algorithmic Complexity DoS

The vulnerability of the Django web application framework is related to its algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

EUVD-2019-19901

phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to extract...

EUVD-2026-13964

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact wi...