IBM Security QRadar EDR 加密问题漏洞

IBM Security QRadar EDR is a terminal detection and response software developed by the American multinational company IBM. There are vulnerabilities related to encryption in versions 3.12 to 3.12.23 of IBM Security QRadar EDR. These vulnerabilities stem from the use of encryption algorithms that...

Advisory ROSA-SA-2026-3203

Software: unbound 1.16.2 OS: ROSA Virtualization 2.1 unaffected versions = unbound-1.16.2-5.9.rv3 affected versions unbound-1.16.2-5.9.rv3 CVE-ID: CVE-2025-5994 BDU-ID: 2025-12600 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Unbound DNS server is related to the loading of external unreliable...

CVE-2026-20640

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3. An attacker with physical access to iPhone may be able to take and view screenshots of sensitive data from the iPhone during iPhone Mirroring with Mac...

Spree 安全漏洞

Spree is an open-source e-commerce platform developed using Ruby on Rails by a personal developer. Vulnerabilities exist in versions prior to Spree 5.0.8, 5.1.10, 5.2.7, and 5.3.2. These vulnerabilities allow unverified users to view completed guest orders, potentially leading to the disclosure o...

The vulnerability of the snd_usbmidi_output_open() function in the sound/usb/midi.c module, which is part of the Linux operating system’s USB audio device support, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the sndusbmidioutputopen function in the sound/usb/midi.c module, which supports USB audio devices in Linux operating systems, stems from the reallocation of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker t...

CVE-2026-0620

When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality...

VulnCheck KEV: CVE-2025-1023

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

SUSE CVE-2025-15469

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

CVE-2025-15469

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38158)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38158 advisory. - In the Linux kernel, the following vulnerability has been resolved: hisiaccvfiopci: fix XQE dma address erro...

EUVD-2026-2765

ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data ...

CVE-2021-47768

ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data ...

CVE-2021-47768 ImportExportTools NG 10.0.4 - HTML Injection

ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data ...

CVE-2026-22907

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data...

SICK TDC-X401GL has security vulnerabilities

The SICK TDC-X401GL is a edge computing gateway developed by the German company SICK. The SICK TDC-X401GL has a security vulnerability. This vulnerability allows attackers to access the host file system without authorization, potentially leading to the reading and modification of system data...

PT-2026-3044

Name of the Vulnerable Software and Affected Versions ImportExportTools NG version 10.0.4 Description ImportExportTools NG has a persistent HTML injection issue in the email export module. Remote attackers can inject malicious HTML payloads. Attackers can send emails with crafted HTML in the...

JetBrains TeamCity Guest Access Detected

JetBrains TeamCity is a continuous integration and build management system that allows guest access if the feature is enabled. If guest login is enabled, an attacker can access the TeamCity server without authentication, potentially leading to unauthorized access to sensitive information and syst...

CVE-2025-37181

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading...

CVE-2019-2561

Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications subcomponent: Internal Operations. Supported versions that are affected are 7.0 and 7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reta...

CVE-2020-12048

Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption e.g., TLS/SSL when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker wi...