CVE-2026-111884

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel UserController::updateData, api/user/data/update, checking only the session and CSRF token. An attacker with a hijacked session can set the e-mai...

grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CLSA-2026-1792256009 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.9-tuxcare.3...

CLSA-2026-1792256007 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.8-tuxcare.1...

CLSA-2026-1792256008 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.5.1-tuxcare.1...

CLSA-2026-1792256005 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.0.0-alpha.15-tuxcare.1...

CLSA-2026-1792256004 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.0.0-alpha.17-tuxcare.1...

CLSA-2026-1792256003 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.6-tuxcare.1...

CLSA-2026-1792256002 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.2-tuxcare.1...

CLSA-2026-1792256001 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

CLSA-2026-1792256000 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.0-tuxcare.1...

CLSA-2026-1792255999 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.7-tuxcare.2...

CLSA-2026-1792255997 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 15.1.3-tuxcare.1...

CLSA-2026-1792255998 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 15.1.3-tuxcare.2...

CLSA-2026-1792255995 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 12.3.7-tuxcare.1...

CLSA-2026-1792255996 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 13.6.9-tuxcare.1...

CLSA-2026-1792255994 TuxCare security update for @react-native-community/cli-server-api (1 CVE)

TuxCare rebuilt @react-native-community/cli-server-api to address 1 CVE. Fixed in 11.4.1-tuxcare.1...

Gitea information leakage vulnerability

The Gitea version from 1.22.0 to 28.1.0 has an information leakage vulnerability. This vulnerability arises from the assets list returned during the creation of draft releases via API. These assets are built from releases without IDs, which matches all attachments not associated with any releases...

David Courtey: Database Authorization Vulnerability

David Courtey: Versions of the DatabaseEngine 1.8.1 and earlier have an authorization issue. This vulnerability stems from the improper handling of the parameter schemaname by the Scheduled Restore component in the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php. As a result,...