EUVD-2024-55844

Missing Lock Bit Protection in the Northbridge IO NBIO could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability...

CVE-2024-36309

A missing Lock Bit Protection in the Northbridge IO (NBIO) allows a privileged attacker to perform a remapping attack. This attack involves using an intentionally disabled device, potentially impacting the confidentiality, integrity, or availability of the system data. The vulnerability is associ...

CRM Platform SQL Injection

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

AcyMailing < 10.11.1 - Unauthenticated SQL Injection

AcyMailing component for Joomla 10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input. id: CVE-2026-56292 info: name: AcyMailing 10.11.1 - Unauthenticated SQL Injection author: str4k3r severity:...

Improper Locking of NBIO Devices Could Allow Privileged Remapping Attacks

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2024-36309| Missing Lock Bit Protection in the Northbridge IO NBIO could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially...

CVE-2026-115998

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

EUVD-2026-109262

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CVE-2026-115998

An Insecure Direct Object Reference (IDOR) vulnerability exists in Cervantes version v1.3-beta . This flaw allows an authenticated attacker to access sensitive data from projects they do not own, including proof-of-concept details , credentials , and client information . Furthermore, the attacker...

CVE-2026-115998 IDOR: User reads and modifies findings from other people's projects

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

PT-2026-122566

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects,...

CervantesSec Cervantes authorization issue vulnerability

Versions 0.3 through 1.3-beta of CervantesSec contain an authorization issue vulnerability. This vulnerability stems from unsafe direct object references; authenticated attackers can access sensitive findings, concept validation details, credentials, and customer information that do not belong to...

CVE-2026-93160

A flaw was found in the Linux kernel's atmel-ecc cryptographic driver. The hardware Elliptic Curve Diffie-Hellman ECDH computation could use a private key that was not generated for the current cryptographic operation. This issue arises because the public key is only cached after a private key is...

OESA-2026-4274 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

OESA-2026-4275 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

OESA-2026-4273 kafka security update

Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications. Security Fixes: Information exposure vulnerability has been identified in Apache Kafka...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, ther...

Astra Linux – vulnerability in libhibernate3-java

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. An SQL injection in the implementation of the JPA Criteria API can allow un sanitized literals to be used when a literal appears in the SQL comments of a query. This flaw may enable an attacker to access...

Astra Linux - Vulnerability in Ceph

An authentication flaw was discovered in Ceph versions prior to 14.2.20. When the monitor processes CEPHXGETAUTHSESSIONKEY requests, it fails to sanitize the otherkeys parameter, allowing keys to be reused. An attacker capable of requesting a globalid can exploit the fact that any user can reques...

Astra Linux – vulnerability in libwebp

A flaw was found in libwebp in versions prior to 1.0.1. A heap-based buffer overflow is possible in the WebPDecodeRGBInto function due to an invalid check on buffer size. The primary risks associated with this vulnerability are data confidentiality, data integrity, and system availability...