EUVD-2026-56236

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

CVE-2026-56721 CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720

CVE-2026-56720 — CamaleonCMS

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

EUVD-2026-56232

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-19078 Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2026-19078 Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2026-19078

CVE-2026-19078 affects the oauth-server component. The open redirect occurs when the then parameter in the grant-approval handler is not properly validated, allowing an authenticated user to be redirected to an attacker-controlled site. Impact could enable phishing to steal sensitive information....

EUVD-2026-56228

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2026-19078

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

CVE-2026-68390

A flaw was found in the Linux kernel's Bluetooth subsystem, specifically within the hcisync component. This vulnerability occurs because the hciconnparamslookup function does not properly hold a necessary lock hdev-lock during operations. This oversight can lead to unsafe list iterations or...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Hadoop

Summary Multiple vulnerabilities in Apache Hadoop that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2014-0229 DESCRIPTION: Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization f...

Exploit for Injection in Glpi-Project Glpi

Да. Ниже именно сырой Markdown-текст — копируй содержимое блока...

Exploit for Injection in Glpi-Project Glpi

CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914, a co...

JLSEC-2026-1248 A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL...

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

udisks2: udisks2: Local Privilege Escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

SonicWall GMS Security Affected By Multiple Vulnerabilities

SonicWall GMS Virtual Appliance, Windows - 9.5.1 and earlier versions are vulnerable to the following security issues.1 CVE-2026-66145 - An unauthenticated remote code execution vulnerabilityAn unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and...

SonicWall Email Security Affected By Multiple Vulnerabilities

1 CVE-2026-66149 - Improper Control of Generation of Code 'Code Injection' Vulnerability via netmaskImproper Control of Generation of Code 'Code Injection' Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restrict...