CVE-2026-62998

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

Vulnerabilities found in IBM Langflow OSS and IBM MQ Appliance

IBM has identified 12 vulnerabilities in IBM MQ, IBM MQ Appliance, and Langflow OSS. These vulnerabilities could allow for the execution of arbitrary code or commands. Four of these vulnerabilities are classified as critical and can be exploited without authentication or user interaction. The...

DEBIAN-CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

AZL-104940 CVE-2026-96512 affecting package sudo 1.9.17-3

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-62998

The REDAXO PHP-based content management system is vulnerable to an unauthorized ORDER BY identifier injection in versions prior to 5.21.2 . The root cause is located in rex_list::getSortColumn() within redaxo/src/core/lib/list.php, which fails to verify if a requested column was registered via se...

CVE-2026-96512 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-96512

A flaw exists in sudo where time-based access restrictions (NOTBEFORE or NOTAFTER ) that omit the trailing 'Z' timezone indicator rely on the TZ environment variable inherited from the user. Because sudo is a setuid-root program, an unprivileged local user can manipulate the TZ variable to shift ...

EUVD-2026-85290

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-96512 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-96512 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool. 🎯 What is this? This is a...

xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location e.g., in the $XDGDATAHOME/mime/magic path is parsed by an...

Moderate: Red Hat Security Advisory: glib2 security update

An update for glib2 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-13676)

Summary A domain label parsing boundary vulnerability in the fast-uri URI parsing library CVE-2026-13676 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368 Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...