libssh2: integer overflow via large username or password arguments

A flaw was found in the libssh2 library. A remote attacker can exploit an integer overflow vulnerability in the userauthpassword function by manipulating the usernamelen or passwordlen arguments and cause a heap-based buffer overflow. This leads to a crash to the application linked to the library...

EUVD-2026-19818

Parse Server has a login timing side-channel reveals user existence...

Red Hat OpenShift Mirror Registry 安全漏洞

Red Hat OpenShift Mirror Registry is a lightweight container image repository service provided by Red Hat Corporation. There is a security vulnerability in Red Hat OpenShift Mirror Registry. This vulnerability stems from failed authentication processes and different error messages during account...

PT-2026-31329

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation...

CVE-2026-39344

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...

CVE-2026-39321

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the...

CVE-2026-39321

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the...

CVE-2026-39321

Parse Server is vulnerable prior to versions 9.8.0-alpha.6 and 8.6.74 due to a timing discrepancy in the login endpoint. An unauthenticated attacker can enumerate valid usernames because responses differ: if the user is not found, the server responds immediately; if the user exists but the passwo...

CVE-2026-39344

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...

CVE-2026-39344

ChurchCRM prior to 7.1.0 is affected by a reflected XSS on the login page via the username parameter from the URL. The vulnerability arises from lack of sanitization/encoding, allowing injected scripts to execute in the user’s browser and potentially steal data such as cookies or alter the login ...

CVE-2026-39344 Reflected XSS the login page through the 'username' parameter

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...

CVE-2026-39344 Reflected XSS the login page through the 'username' parameter

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...

EUVD-2026-19849

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...

CVE-2026-39344 Reflected XSS the login page through the 'username' parameter

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...

freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2()

A null pointer dereference has been discovered in FreeRDP. A NULL pointer dereference vulnerability in rdpwritelogoninfov2 allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0...

Exploit for CVE-2007-2447

SMB Samba Exploitation Metasploitable 2 📌 Overview This...

Exploit for Classic Buffer Overflow in Pjsip

CVE-2026-25994 – PJNATH ICE Stack Buffer Overflow pjsip ≤ 2.16...

PT-2026-30967

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting XSS vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly...

ChurchCRM 安全漏洞

ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.1.0 contained security vulnerabilities. These vulnerabilities stemmed from the username parameter on the login page not being cleaned or encoded properly, which could lead to reflection-type cross-site...

Parse Server 安全漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that runs Node.js. There were security vulnerabilities in versions of Parse Server prior to 9.8.0-alpha.6 and 8.6.74. These vulnerabilities stemmed from differences in login endpoint...