EUVD-2026-52057

In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767...

CVE-2026-54365

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

CVE-2026-51119

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...

CVE-2026-51119

A privilege escalation vulnerability exists in Invixium IXM WEB v.2.3.85.25 due to a lack of server-side authorization checks on the POST /SystemUsers/CreateAppUser endpoint. An authenticated user with low privileges can exploit this flaw to create a new administrator account, granting them full ...

Security Bulletin: CockroachDB PostgreSQL for IBM VPC is vulnerable to privilege escalation when using RESTORE SYSTEM USERS functionality (CVE-2026-9839)

Summary CockroachDB PostgreSQL for IBM VPC is vulnerable to privilege escalation when using RESTORE SYSTEM USERS functionality CVE-2026-9839 Vulnerability Details CVEID:CVE-2026-9839 DESCRIPTION: CockroachDB PostgreSQL for IBM VPC is vulnerable to privilege escalation when using RESTORE SYSTEM...

cPanel 输入验证错误漏洞

cPanel is a web-based automated hosting platform developed by cPanel Inc. This platform is primarily used for automating the management of websites and servers. cPanel has a vulnerability related to input validation errors, which stem from insufficient input validation in the plugin parameter...

CVE-2026-20448

In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10708513; Issue ID: MSV-6281...

CVE-2026-20447

In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10724073; Issue ID: MSV-6296...

PT-2026-36766

Name of the Vulnerable Software and Affected Versions geniezone affected versions not specified Description A missing permission check allows for a possible local escalation of privilege. This issue can be exploited by a malicious actor who has already obtained the System privilege, and it does n...

📄 Cockpit CMS 2.13.5 NoSQL Injection

Cockpit CMS version 2.13.5 is vulnerable to NoSQL operator injection on multiple API endpoints. User-supplied filter objects are forwarded to the Mongolite query engine without stripping MongoDB operators. Authenticated users can bypass intended query filters and perform boolean-based blind queri...

CVE-2019-11658

Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited subset of records they would not normally be able to access when the system is in an undisclosed...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the totalResult field. An attacker can gain access to the total number of instance users by querying this field, even without specific permissions. Workaroun...

The vulnerability of the endpoint of the Nagios Log Server software monitoring and analysis tool allows a malicious actor to extract administrative API keys in an unencrypted form.

The vulnerability of the final endpoint of the Nagios Log Server monitoring and analysis software relates to the disclosure of system data that is not authorized for the controlled area. Exploiting this vulnerability allows a malicious actor to extract administrative API keys in an unencrypted fo...

EUVD-2018-5305

Malware in sbrugna...

PT-2025-37708

Name of the Vulnerable Software and Affected Versions IBM OpenPages versions 9.0 and 9.1 Description IBM OpenPages versions 9.0 and 9.1 allow web page cache to be stored locally, which can then be read by another user on the same system. Recommendations At the moment, there is no information abou...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the save process in the /system/users/save path when handling the name or email arguments. An attacker can inject arbitrary web script or HTML by submitting crafted input to these parameters. Details...

Cockpit 代码注入漏洞

Cockpit is an interactive server management interface for Cockpit open source. A code injection vulnerability exists in Cockpit 2.11.3 and earlier versions, which stems from a cross-site scripting attack due to incorrect manipulation of the parameters name/email in the file /system/users/save...

CVE-2025-7053: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be initiated remotely. Upgrading to version...

CVE-2025-24287

CVE-2025-24287 affects Veeam Agent for Microsoft Windows prior to version 6.3.2.1205. A local vulnerability allows a local system user to modify directory contents, enabling arbitrary code execution with elevated permissions on the host. Public sources in the connected set corroborate this descri...

CVE-2023-26427

Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known...