CVE-2026-107033: n/a: Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows…

Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 versionCode 60 allows unauthorized attackers to arbitrarily read and modify another user's task database...

CVE-2026-107045: n/a: Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized…

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 versionCode 62 allows unauthorized attackers to arbitrarily read another's Nostr event database...

CVE-2026-107033

Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 versionCode 60 allows unauthorized attackers to arbitrarily read and modify another user's task database...

CVE-2026-107021

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database...

CVE-2026-107033

The Mirakel application (v3.0, versionCode 60) is affected by a security vulnerability involving insecure permissions in the MirakelInternalContentProvider component. This flaw allows unauthorized attackers to arbitrarily read and modify another user's task database. The vulnerability is categori...

AXIS Camera Station Pro Versions Before 6.20 Database Backup Decryption

AXIS Camera Station Pro versions before 6.20 and AXIS Camera Station 5 contain an insufficient database-backup encryption scheme that permits offline decryption of stored secrets. This proof of concept derives the AES key from a volume serial and decrypts encrypted values...

MiracleLinux 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (AXSA:2026-2174:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2174:01 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

PT-2026-132393

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database...

Server Optimizer DoS

Vulnerability of the Server component: The Optimizer for Oracle Database Management System MySQL Server is affected by uncontrolled resource consumption. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-54455

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in home:CallsDataGrid and activity:ActivityDataGrid uses request-controlled period, startDate and endDate parameters without...

CVE-2026-61569 AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-61569 AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at "objects/login.json.php" passes the "user" parameter to "Streamer::get" in "objects/Streamer.php", where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-61569 AVideo-Encoder: pre-authentication streamer-login SQL injection

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

EUVD-2026-112553

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although...

CVE-2026-61569

The video-sharing platform AVideo is vulnerable to a pre-authentication SQL injection in versions prior to 8.1.0 . The vulnerability exists because the user parameter at objects/login.json.php is passed to Streamer::get in objects/Streamer.php and interpolated into a MariaDB SELECT query without ...

EUVD-2026-112509

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in home:CallsDataGrid and activity:ActivityDataGrid uses request-controlled period, startDate and endDate parameters without...

CVE-2026-77167

A flaw was found in Nextcloud. An unauthenticated remote attacker can abuse the federated sharing endpoint to inject arbitrary rows into the database. Because these entries are never automatically cleaned up, they cause persistent Denial of Service DoS conditions that disrupt system availability...

DRUPAL-CONTRIB-2026-291

This module enables you to share and reuse content across websites. The module did not sufficiently encrypt the password of the system user used when synchronizing content. This can potentially allow unprivileged users to view the password. This vulnerability is mitigated by the fact that an...