Drupal 11.x-dev - Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. id: CVE-2024-45440 info: name: Drupal 11.x-dev - Full Path Disclosure author: DhiyaneshDK severity: medium description: |...

dive

dive A tool for exploring a Docker image, layer contents, and discovering ways to shrink the size of your Docker/OCI image. To analyze a Docker image simply run dive with an image tag/id/digest: dive or you can dive with Docker directly: alias dive="docker run -ti --rm -v...

CVE-2025-8110

CVE-2025-8110 - Gogs symlink bypass - arbitrary file write as the Gogs process user Gogs //contents/. Gogs follows the symlink and writes attacker-controlled bytes to the link target with the privileges of the Gogs process. When Gogs runs as root this is an arbitrary root file write - e.g. drop a...

polymorph

Polymorph Polymorph is a tool that facilitates the modification of network traffic on the fly by allowing the execution of Python code on network packets that are intercepted in real time. This framework can be used to modify in real time network packets that implement any publicly specified...

AZL-111179 CVE-2026-103995 affecting package python-py 1.11.0-1

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents...

CVE-2026-103995 Lenient parsing of integers for response body and chunk framing

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents...

CVE-2026-112353

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-112353 GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-112353 GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

EUVD-2026-111136

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-112353

GFI KerioConnect (Kerio Connect) versions before 10.0.8 Patch 2 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Webmail component. An attacker can upload a crafted SVG email attachment that bypasses sanitization of event-handler attributes. By exploiting an insuffi...

PT-2026-128059

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents...

PT-2026-127214

Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents...

PT-2026-126661

Name of the Vulnerable Software and Affected Versions GFI KerioConnect versions prior to 10.0.8 Patch 2 Description A stored cross-site scripting XSS flaw exists in the Webmail component. A remote attacker can execute JavaScript within a victim's authenticated session by uploading a specially...

EUVD-2026-107575

Pillow: Arrow export leaks stale heap memory when PILLOWALIGNMENT 1...

SUSE CVE-2026-114501

Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr even when PILLOWALIGNMENT makes alignedlinesize include row padding or an aligned offset before the first row. The resulting Arrow buffer...

CVE-2022-51021

The NotificationX plugin for WordPress (versions 2.0.0 before 2.3.12) is vulnerable to an unauthenticated SQL injection . An attacker can manipulate database queries by supplying an array-form id parameter to the /wp-json/notificationx/v1/notification/{id} endpoint. Specifically, passing id[1] wi...

Linux Distros Unpatched Vulnerability : CVE-2026-114501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from im-blocks0.ptr...

i-Netsolution Readymade Unilevel Ecommerce MLM SQL injection vulnerability

The i-netsolution Readymade Unilevel Ecommerce MLM version for 2024-03-15 contains an SQL injection vulnerability. This flaw stems from improper input validation of the id parameter in /product-details.php. Unauthorized attackers can exploit this by sending boolean, stack-based, or time-based SLE...

WordPress NotificationX SQL injection vulnerability

WordPress NotificationX versions from 2.0.0 up to 2.3.12 contain an SQL injection vulnerability. This vulnerability stems from improper handling of array-formatted id parameters in /wp-json/notificationx/v1/notification/id. Unauthenticated remote attackers can supply an id containing specially...