CVE-2026-111611

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

EUVD-2026-103033

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111611 roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111611

The roncoo-education platform, through version 25.0.0-RELEASE , is affected by an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). This flaw exists in the pay cancel and continue endpoints, where the application fails to perform proper ownership validation. Authenticated users can...

PT-2026-116010

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-109560

Continue CLI @continuedev/cli through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;...

CVE-2026-109560 Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining

Continue CLI @continuedev/cli through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;...

EUVD-2026-97883

Continue CLI @continuedev/cli through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;...

CVE-2026-109560

The Continue CLI (@continuedev/cli) versions through 1.5.47 are vulnerable to a permission bypass (CWE-863). The root cause is that the application allows unapproved commands to be executed by chaining them after allowed Bash prefix rules. An attacker can inject instructions into fetched pages or...

CVE-2026-109560: Incorrect Authorization

Continue CLI @continuedev/cli through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;...

PT-2026-110936

Name of the Vulnerable Software and Affected Versions Continue CLI @continuedev/cli versions prior to 1.5.48 Description A permission bypass exists where the Bash allow-rules use prefix matching on the entire command string. This allows an attacker to execute unapproved commands by chaining them...

Astra Linux – Vulnerability in GhostScript

Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in the sampleddatasample function called from sampleddatacontinue and interp...

Astra Linux – Vulnerability in Qemu

QEMU 5.0.0 has a heap-based Buffer Overflow in the flatviewreadcontinue function in exec.c, as hw/sd/sdhci.c improperly handles a write operation in the SDHCBLKSIZE case...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux (crlsa-2024_7349)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20247349 advisory. net/http: Denial of service due to improper 100-continue handling in net/http CVE-2024-24791 Tenable has extracted the preceding description block directly from the...

DEBIAN-CVE-2026-103399

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

AZL-105543 CVE-2026-103399 affecting package libsoup 3.4.4-16

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

UBUNTU-CVE-2026-103399

A flaw was found in SoupServer libsoup. When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final non-1xx response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-aliv...

CVE-2026-103399

A vulnerability exists in SoupServer (libsoup) where an HTTP/1.x client sending a request with Expect: 100-continue and a request body can trigger request smuggling . If the server returns an early final (non-1xx) response before reading the body, it fails to drain the bytes or close the connecti...