EUVD-2026-56038

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...

CVE-2026-72563

CVE-2026-72563 affects BadChoice Handesk. A broken access control flaw on LeadsController@update allows any authenticated agent to overwrite lead records across team boundaries. Root cause: Lead model guarded is an empty array, making all columns mass-assignable, and no authorization check is per...

EUVD-2026-56019

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning...

CVE-2026-72548

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without...

CVE-2026-72545 OpenSignLabs OpenSign - Insecure Direct Object Reference

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target...

EUVD-2026-56006

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to manipulate any tenant Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe payment intent...

CVE-2026-72536

CVE-2026-72536 (Chaskiq) is a missing-auth vulnerability in Chaskiq up to commit 46dfdd1 that lets unauthenticated remote attackers manipulate any tenant’s Stripe subscription via the stripeCreateIntent GraphQL mutation. The mutation lacks authentication and authorization checks, exposing Stripe ...

EUVD-2026-56005

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

CVE-2026-72535

CVE-2026-72535 affects Chaskiq. A missing authentication flaw (through commit 46dfdd1) allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication/authorization checks before c...

kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled

A flaw was found in the Linux kernel's memory management subsystem. This issue occurs when the kernel's memory allocator attempts to zero out newly allocated memory, but an incorrect check prevents the full memory region from being cleared under specific configurations. This can lead to memory no...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs

A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service DoS for the affected system...

Malicious code in morpho-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cb58dff63faa08e128ddd0d8d38b82c0711bb60d09d19755a8e8f398fa7d511d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-72694

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link symlink following vulnerability. By influencing or pre-placing a symlink in the process ID PID file path, the attacker can trick...

DEBIAN-CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-15562

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 or :9990, or :4447 and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service...

CVE-2026-15565

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-68151

A flaw was found in the Linux kernel's binfmtelffdpic component. This component, which handles FDPIC ELF binaries, does not correctly process multiple PTINTERP program headers. An unprivileged local attacker can exploit this by crafting a malicious binary with more than one PTINTERP header...

CVE-2026-73145

A flaw was found in svxlink's asynchronous HTTP server. No limits are enforced on incoming HTTP request-line or header sizes. A remote attacker can send excessively large requests to exhaust available memory, resulting in a denial of service. Mitigation Update svxlink to version 26.05.1 or later...

CVE-2026-71217 Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as parallel and len, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread...

CVE-2026-71217

This CVE affects iperf3. The flaw arises from improper validation of control-channel JSON, where oversized numeric parameters (e.g., parallel, len) can trigger excessive stream/thread creation and large buffer allocations, leading to resource exhaustion and a Denial of Service on the affected ipe...