6942 matches found
PT-2026-99865
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...
Debian dla-4797 : lemonldap-ng - security update
The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4797 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4797-1 [email protected] https://www.debian.org/lts/security/...
busybox: busybox: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
CVE-2026-97896
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...
CVE-2026-97896 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...
EUVD-2026-87281
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...
CVE-2026-97896
The krayin laravel-crm software (versions up to 2.2.5 ) is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the ConfigurationForm::rules function within the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the Upload Functionality component. This vulnerability al...
CVE-2026-97896 krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...
CVE-2026-97896: Improper Neutralization of Input During Web Page Generation
A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The...
PT-2026-99095
Name of the Vulnerable Software and Affected Versions krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists within the Upload Functionality component. The flaw is located in the ConfigurationForm::rules function of the...
CVE-2026-98016
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...
GHSA-2JX3-FF3V-J7JJ yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
!NOTE This finding was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review and verification. The Issue The crate exports a public safe API Rules::deserialize accepting any generic byte sequence B: AsRef. It restores compiled rule structures direct...
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
!NOTE This finding was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review and verification. The Issue The crate exports a public safe API Rules::deserialize accepting any generic byte sequence B: AsRef. It restores compiled rule structures direct...
SUSE CVE-2026-88831
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients...
SUSE CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...
CVE-2026-79760 Termix: Authenticated blind SSRF through notification channel test endpoints
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests...
PT-2026-105471
!NOTE This finding was identified during an agentic unsafe Rust code review performed by Gemini AI, followed by human review and verification. The Issue The crate exports a public safe API Rules::deserialize accepting any generic byte sequence B: AsRef. It restores compiled rule structures direct...
CVE-2026-92700
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...
github.com/openfga/openfga: OpenFGA: Unauthorized access due to ListUsers API returning deliberately excluded users.
A flaw was found in OpenFGA, an authorization and permission engine. The ListUsers application programming interface API could incorrectly return users who should have been excluded from authorization decisions. This vulnerability arises when complex authorization rules, involving both exclusions...