CVE-2026-25057

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...

CVE-2026-24885 Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery CSRF vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the...

CVE-2026-24885

Kanboard (Kanban project management software) is affected by a CSRF flaw in the ProjectPermissionController prior to version 1.2.50. The root cause is the server not strictly enforcing Content-Type: application/json for the changeUserRole action, accepting text/plain despite a JSON body. This all...

The vulnerability of the qla2x00_bsg_job_done() function in the drivers/scsi/qla2xxx/qla_bsg.c module of the Linux system’s SCSI device support driver allows a hacker to cause a service failure.

The vulnerability of the qla2x00bsgjobdone function in the drivers/scsi/qla2xxx/qlabsg.c module of the Linux SCSI device support driver is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

AMD µProf Vulnerability

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Score ---|---|--- CVE-2025-61969| Incorrect permission assignment in AMD µProf performance analysis tool-suite may allow a local user-privileged attacker to achieve privilege escalation, potentially resulting in...

CVE-2026-25057

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...

CVE-2026-25057

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...

CVE-2026-25057 Zip Slip in MarkUs config upload allowing RCE

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...

Incorrect Privilege Assignment

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to insufficient ownership verification in the UserManagedPermissionService...

PT-2026-7132

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.9.1 Description MarkUs is a web application used for submitting and grading student assignments. Prior to version 2.9.1, instructors could upload a zip file to create an assignment from an exported configuration via...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to an arithmetic overflow in the network policy priority assignment process. An attacker can cause incorrect traffic enforcement by creating a large number of policies with various priority values...

Exploit for Expression Language Injection in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

ButtF - Backend Misconfiguration & Logic Flaw Exploitation Too...

Exploit for CVE-2025-2304

CVE-2025-2304 - Camaleon CMS 2.9.0 - Privilege Escalation Expl...

The vulnerability in the vmw_cmd_dma() function of the drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c file, a driver for the Direct Rendering Infrastructure (DRI) of the Linux operating system, allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the vmwcmddma function in the drivers/gpu/drm/vmwgfx/vmwgfxexecbuf.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the bus_error030() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the buserror030 function in the Linux operating system is related to the assignment of the NULL pointer. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Exploit for CVE-2025-2304

Exploit-for-CVE-2025-2304 usage: exploit.py -h --url URL --...

CVE-2026-24665

The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting XSS vulnerability allows authenticated students to inject malicious JavaScript into uploaded assignment files, which is executed when instructors vie...

Exploit for CVE-2025-2304

Camaleon CMS 2.9.0 – Authenticated Privilege Escalation Role...

The vulnerability of the imx_uart_probe() function in the drivers/tty/serial/imx.c module of the console TTY driver in the Linux kernel’s serial port allows a hacker to cause a service failure.

The vulnerability of the imxuartprobe function in the drivers/tty/serial/imx.c module of the console TTY driver in the Linux kernel’s serial port is related to the assignment of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-24665

The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting XSS vulnerability allows authenticated students to inject malicious JavaScript into uploaded assignment files, which is executed when instructors vie...