CVE-2026-41659

CVE-2026-41659 (Admidio) : The Admidio member assignment data endpoint before 5.0.9 includes hidden profile fields (BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY) in the SQL search condition, regardless of visibility settings. While JSON output hides these fields, the server-side search runs on the h...

Admidio 信息泄露漏洞

Admidio is a set of open-source member management systems developed by the Admidio team. This system supports features such as member lists, event management, message boards, photo albums, and downloads. Prior to Admidio 5.0.9, there was a vulnerability involving information leakage. This...

CVE-2026-43510: Incorrect Privilege Assignment

manage.get.gov is the .gov TLD registrar maintained by CISA. manage.get.gov allows an organization administrator to assign domain manager privileges for domains not already in another organization. Fixed in 1.176.0 on or around 2026-04-30...

CVE-2026-42435 OpenClaw 2026.2.22 < 2026.4.12 - Shell-Wrapper Detection Bypass via Environment Variable Assignment Injection

OpenClaw versions from 2026.2.22 before 2026.4.12 contain an insufficient shell-wrapper detection vulnerability allowing attackers to inject environment variable assignments at the argv level. Attackers can bypass exec preflight handling to manipulate high-risk shell variables like SHELLOPTS and...

CVE-2026-6499

Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto: 1.7.5...

CVE-2026-6499

Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto: 1.7.5...

CVE-2026-41686: Incorrect Permission Assignment for Critical Resource

Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.91.1, the BetaLocalFilesystemMemoryTool in the Anthropic TypeScript SDK created memory files and directories using the Node.js default modes...

The vulnerability of the PARSEC security subsystem, related to pointer assignment errors, allows a perpetrator to trigger a service failure.

The vulnerability of the PARSEC security subsystem is related to pointer assignment errors. Exploiting this vulnerability could allow an attacker to trigger a service failure...

CVE-2026-6499: Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto: 1.7.5...

deephas 1.0.7 - Prototype Pollution

Exploit Title: deephas 1.0.7 - Prototype Pollution Google Dork: N/A Date: 2026-02-01 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Vendor Homepage: https://www.npmjs.com/package/deephas Software Link: https://github.com/sharpred/deepHas Version: =...

GHSA-68PR-7PRH-MPV4 Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment

Summary The member assignment DataTables endpoint membersassignmentdata.php includes hidden profile fields BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible checks,...

Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment

Summary The member assignment DataTables endpoint membersassignmentdata.php includes hidden profile fields BIRTHDAY, STREET, CITY, POSTCODE, COUNTRY in its SQL search condition regardless of field visibility settings. While the JSON output correctly suppresses hidden columns via isVisible checks,...

CVE-2026-5141

Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3...

Sensitive data disclosure and manipulation due to unnecessary privileges assignment

...

CVE-2026-22337

Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4...

CVE-2026-5141: Improper Privilege Management

Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3...

CVE-2026-7424: Integer Underflow (Wrap or Wraparound)

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6 address assignment, DNS configuration, and lease times, and to cause a denial of service permanent IP task freeze requiring hardware reset ...

The vulnerability of the ath12k_mac_mgmt_tx_wmi() function in the drivers/net/wireless/ath/ath12k/mac.c file of the Atheros/Qualcomm wireless adapter driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ath12kmacmgmttxwmi function in the drivers/net/wireless/ath/ath12k/mac.c file of the Atheros/Qualcomm wireless adapter driver in the Linux operating system is related to the assignment of the NULL pointer pointer. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the kset_register() function in the lib/kobject.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the ksetregister function in the lib/kobject.c module of the Linux kernel is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the mlx5_ldev_free() function in the drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c file of the Mellanox Ethernet network adapter driver for the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the mlx5ldevfree function in the drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c file of the Mellanox Ethernet network adapter driver for the Linux operating system is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to caus...