EUVD-2026-48450

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

EUVD-2026-48439

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

EUVD-2026-48444

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-16767

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-16764

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16767

The CVE-2026-16767 entry concerns Ne-Lexa php-zip, affecting ZipFile::extractTo in src/ZipFile.php of the ZIP Handler up to version 4.0.2. The root cause is manipulation of the argument entryName, enabling path traversal. This can be exploited remotely and the exploit is public. The documents do ...

CVE-2026-16767 Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-16765

CodeAstro Online Classroom 1.0 contains a vulnerability in the file /OnlineClassroom/loginlinkadmin.php where manipulating the argument aid can trigger an SQL injection. The issue can be exploited remotely without authentication, and public exploit guidance exists. Affected component: loginlinkad...

CVE-2026-16765 CodeAstro Online Classroom loginlinkadmin.php sql injection

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-16764

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-16764

The CVE pertains to OWASP DefectDojo 2.59.0, where the UserSerializer in dojo/api_v2/serializers.py mishandles the is_staff argument, enabling improper privilege management. This issue can be exploited remotely; an exploit exists publicly. Remediation is to upgrade to DefectDojo 2.58.3 or 3.0.0, ...

CVE-2026-16764 OWASP DefectDojo API/Web serializers.py UserSerializer privileges management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

CVE-2026-65703

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdscparsetdsf function fails to unreference the...

JLSEC-2026-784

A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftpextensionsgetname/sftpextensionsgetdata of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may ...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Network of Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 150.0.7871.46, writing Tint in Google Chrome allowed a remote attacker to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: High...