EUVD-2026-97832

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue...

CVE-2026-92120 Apache Allura: Oauth1 Replay Attack

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue...

CVE-2026-108927

The itsourcecode Baptism Information Management System 1.0 is vulnerable to SQL injection due to improper handling of the b_id argument in the pbaptism.php file. This weakness can be triggered remotely. Public exploits for this vulnerability are available and have been reported as sighted in the ...

EUVD-2026-97818

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

CVE-2026-109575

In HAProxy Data Plane API 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases, Server.ConfigureAPI has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority tlsca is configured and a numeric TLS...

EUVD-2026-97814

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried...

CVE-2026-108924 getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried...

EUVD-2026-97813

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation...

CVE-2026-104364

IBM Db2 (Server edition) versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 across all platforms are vulnerable to a Denial of Service (DoS) attack. The root cause is improper input validation (CWE-20), which could be exploited by a local attacker . To remediate this vulnerability, customer...

CVE-2026-104364 IBM® Db2® Denial of Service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation...

CVE-2026-83536

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-108921

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysqlquery of the file removeannouncements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missi...

CVE-2026-108920

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...

CVE-2026-105464

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to gain elevated privileges due to improper privilege management...

CVE-2026-108362 Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...

CVE-2026-108362

Privasys Remote Attestation TLS Clients versions prior to 0.11.0 are vulnerable to a diversion attack due to an Origin Validation Error (CWE-346). The software fails to require an explicitly authorized platform identity, meaning it accepts TEE attestation evidence from any unrevoked platform. A n...

CVE-2026-108362 Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...

CVE-2026-108922

A flaw in the KusalkaSilva Learning-Management-System (up to commit ffeb873f8803f1e9664384ff75000c7da45466d2 ) allows for unrestricted upload of files. The vulnerability exists in the getimagesize function of the upload_save.php file, where a manipulation of the uploaded_file/image argument can b...

CVE-2026-83536 Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris)

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-83536

A flaw in openstack-network-exporter allows an unauthenticated, remote attacker to perform a Slowloris-style Denial of Service (DoS) attack. The HTTP server component lacks essential timeout settings, such as ReadHeaderTimeout , enabling an attacker to initiate multiple slow HTTP header connectio...