CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

Updated bind packages fix a security vulnerability

The updated bind packages fix a security vulnerability: When BIND 9 was configured to use DNS64 and encounters a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data...

MGASA-2026-0258 Updated bind packages fix a security vulnerability

The updated bind packages fix a security vulnerability: When BIND 9 was configured to use DNS64 and encounters a DNAME redirect, it could end up using freed memory for the DNS response owner name. This caused the response to contain corrupted data...

[SECURITY] Fedora 43 Update: ruby-3.4.10-31.fc43

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

OPENSUSE-SU-2026:11306-1 kbfs-6.6.3-3.1 on GA media

These are all security issues fixed in the kbfs-6.6.3-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-60991

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /forexam.php. The manipulation of the argument day results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to...

PT-2026-60980

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to...

Linux Distros Unpatched Vulnerability : CVE-2026-48487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in...

PT-2026-60990

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /schoolyr.php. The manipulation of the argument sy leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is...

Malicious code in axios-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906 The package presents itself as a drop-in replacement for axios identical name shape, README, and API but adds a top-level import of a separate npm...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

CVE-2026-54242

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly...

CVE-2026-13221 vulnerabilities

Vulnerabilities for packages: perl...

GHSA-HGVH-MHW9-C77H vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-GC92-VPV6-2C4W vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-PH5F-PJVP-H9X6 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-25XW-CF43-5CCV vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-8635

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions...

DEBIAN-CVE-2026-50289

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces5 source directive because lib/network.js checkLinuxDCHPInterfaces reads /etc/network/interfaces, extracts a...