306557 matches found
EUVD-2026-97293
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMSBanner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this...
SUSE-SU-2026:4624-1 Security update for unbound
This update for unbound fixes the following issues: - CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. - CVE-2026-77955: Possible ZONEMD verification bypass window bsc1280404. - CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission...
Security update for unbound
This update for unbound fixes the following issues: CVE-2026-77860: 'serve-expired' can bypass Unbound 'wait-limit' bsc1280403. CVE-2026-77955: Possible ZONEMD verification bypass window bsc1280404. CVE-2026-78227: Use-after-free in DoQ stream output buffer on reset re-transmission bsc1280405...
CVE-2026-108808
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...
UBUNTU-CVE-2026-78356
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...
CVE-2026-108811 WMCMS index.php information disclosure
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...
EUVD-2026-97283
A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument func results in information disclosure. The attack can be executed remotely. The exploit has been released to t...
CVE-2026-108810
The tsi-coop tsi-dpdp-cms software (versions 0.5.0 , 0.5.1 , and 0.5.2 ) is vulnerable to an information disclosure flaw within the JSON Schema Validation component. The root cause is the improper handling of the _func argument, which allows an unauthenticated remote attacker to execute the attac...
CVE-2026-93582
The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior are vulnerable to an authentication bypass (CWE-290). The root cause is that the application accepts authenticated usernames from the REMOTE_USER or HTTP_REMOTE_USER environment variables. In CGI or mod_perl deployments, ...
CVE-2026-108808 Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...
CVE-2026-108808
A vulnerability exists in Eleveo Call Recording Software up to version 10.3.0 within the JWT Token Handler component. Specifically, the file /auth/realms/default/protocol/openid-connect/logout is affected. By manipulating the id_token_hint argument, an attacker may cause the application to use th...
EUVD-2026-97261
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...
CVE-2026-108803
A security vulnerability has been detected in yproject RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. The manipulation leads to session expiration. It is possible to initiate the attack remotely. The vendor was contacted earl...
CVE-2026-108806
A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysqlquery of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads ...
CVE-2026-108806
A SQL injection vulnerability exists in the krupalshah EmployeeRecruitmentSystem (up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe). The flaw is located in the Forgot Password Handler component within the source/authprocessing.php file, specifically affecting the mysql_query function. Manipu...
CVE-2026-108805 krupalshah EmployeeRecruitmentSystem Login loginprocessing.php mysql_query sql injection
A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysqlquery of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sq...
CVE-2026-21133
Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...
CVE-2026-21135
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...