Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: NVMe: Fixed the failure in reconnection due to reserved tag allocation. We identified an issue in a production environment while using NVMe over RDMA. The reconnection of adminq failed indefinitely, even when the remote target an...

Astra Linux – Vulnerability in Zabbix

A bug in the code allows an attacker to create a forged zbxsession cookie, which enables them to log in with admin permissions...

Astra Linux – Vulnerability in Zabbix

A non-administrator user account on the Zabbix frontend, with the default User role, or any other role that grants API access, can exploit this vulnerability. There is an SQL injection vulnerability in the CUser class within the addRelatedObjects function. This function is called from the CUser.g...

Astra Linux – Vulnerability in Linux

A issue was discovered in netfilter within the Linux kernel before version 5.10. There may be a use-after-free situation in the packet processing context, as the per-CPU sequence count is mishandled during concurrent iptables rule replacements. This vulnerability could be exploited with the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nvme: fixed the lifetime of the admin requestqueue Namespaces can access the controller’s admin requestqueue, and stale references on the namespaces may exist after tearing down the controller. Ensure that the admin requestqueue ...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user belonging to the lpadmin group could use the cups web interface to modify configurations and insert malicious lines. As a result, the cupsd process, running as root...

CVE-2026-59788

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2024-49328-exploit

CVE-2024-49328-exploit 🌟 Description: This script exploits a privilege escalation vulnerability in the WP REST API FNS Plugin for WordPress. The vulnerability affects all versions up to and including 1.0.0, allowing unauthenticated attackers to gain administrator privileges. ⚙️ Usage options: -h,...

CVE-2026-59788

A Stored XSS vulnerability exists in the email media type OAuth form because the application passes the Authorization endpoint value to window.open() without validating the URL scheme. This allows for the execution of a javascript: URL in the browser. An attacker can deliver a crafted media type ...

CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

EUVD-2026-92400

The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...

CVE-2023-22515-Scan.

CVE-2023-22515-Scan About This is simple scanner for CVE-2023-22515, a critical vulnerability in Atlassian Confluence Data Center and Server that is actively being exploited in the wild by threat actors in order "to create unauthorized Confluence administrator accounts and access Confluence...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105253

A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed...

CVE-2026-105062

Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17...

CVE-2026-105254

A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

UBUNTU-CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105263 Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...