PT-2026-72506

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the parse dfs referrals function where string offsets supplied by the server are used to compute DfsPath and NetworkAddress string pointers without verifying if they...

Linux Distros Unpatched Vulnerability : CVE-2026-72318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cifs: validate DFS referral string offsets parsedfsreferrals validates that the response header and referral array fit in the received buffer, but each referral...

Exploit for Injection in Budibase

CVE-2026-31816 — Budibase Authentication Bypass → RCE !CVE...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-56755

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-56755 Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

EUVD-2026-58146

Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload...

CVE-2026-56755

The Git repository management system Gitea is vulnerable to a Denial of Service (DoS) via CPU & Memory Exhaustion . The root cause is insufficient resource control during O(N^2) string concatenation within the ParseControlFile() function located in modules/packages/debian/metadata.go. A malicious...

CVE-2026-59109

Summary: CVE-2026-59109 concerns the Zalktis accounting application, where SQL injection can be triggered via trading-partner‑controlled fields in received electronic invoices. What is affected: Zalktis before 2026.1.586 and before 2026.2.592. The issue occurs when importing a received e‑invoice ...

EUVD-2026-58133

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...

DEBIAN-CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

JLSEC-2026-1290

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including KernelFloat and Stringtof...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

PT-2026-71703

Name of the Vulnerable Software and Affected Versions Zalktis versions prior to 2026.1.586 Zalktis versions prior to 2026.2.592 Description An issue exists where the application concatenates partner-controlled values directly into SQL statement text during the import of received electronic invoic...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...