PT-2026-91818

TuxCare rebuilt ws to address 3 CVEs. Fixed in 8.13.0-tuxcare.1...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cockpit (UTSA-2026-106156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106156 advisory. A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowi...

PT-2026-91819

TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.5-tuxcare.1...

OESA-2026-3578 cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. Security Fixes: A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses ws-7.5.11.tgz which is vulnerable to CVE-2026-62389.

Summary IBM Maximo Application Suite - Monitor Component uses ws-7.5.11.tgz which is vulnerable to CVE-2026-62389. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...

com.mysema.web:webmin (0.2.3), org.parancoe:parancoe (0.3.3) +11 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (2.0.7)

org.springframework:spring-webmvc MAVEN version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.mysema.web:webmin 0.2.3 - org.parancoe:parancoe 0.3.3 - org.parancoe:parancoe-core 0.3.3 ...

net.sourceforge.jfacets:jfacets-acegi (>=3.1, <=3.2.1), org.acegisecurity:acegi-security (1.0.3) +11 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (1.2.8)

org.springframework:spring-webmvc MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - net.sourceforge.jfacets:jfacets-acegi =3.1, =0.5, =0.8, =0.8a Source cves: CVE-2026-47884...

com.sun.jersey:jersey-spring (0.8-ea), org.springframework.ws:spring-ws-core (1.5.0) +4 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (2.5.2)

org.springframework:spring-webmvc MAVEN version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.sun.jersey:jersey-spring 0.8-ea - org.springframework.ws:spring-ws-core 1.5.0 -...

CVE-2026-81676: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81675: Improper Neutralization of Special Elements used in an SQL Command

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81672: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the idvideo parameter. The application does not sanitize input before constructing SQL queries, which results in execution errors when malicious input is provided. The vulnerability exposes...

CVE-2026-81674: Improper Neutralization of Special Elements used in an SQL Command

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

metasploit -- multiple vulnerabilities

Rapid7 published security advisories for issues fixed in releases 6.5.2 through 6.5.7. The credential endpoint of the msf-ws REST API is reachable without authentication, authentication in the JSON-RPC service is skipped when the database health check fails, a post module writes files outside the...

CVE-2026-80234

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

CVE-2026-80234 CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

CVE-2026-80234 CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

EUVD-2026-66343

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

CVE-2026-80233

CAYIN Technology's CMS-WS, CMS-SE, and SMP series products are affected by an arbitrary file upload vulnerability. A privileged remote attacker can upload and execute web shells, enabling arbitrary code execution on the server. Per the CVSS 3.1 score of 7.2 (HIGH) from TWCERT, the attack requires...

CVE-2026-80233 CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-80233 CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server...