9003 matches found
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the authorId parameter during the entry creation. An attacker can assign authorship of new entries to...
GHSA-2XFC-G69J-X2MP Craft CMS: Entries Authorship Spoofing via Mass Assignment
Description The entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds or authorId parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign...
GHSA-94RC-CQVM-M4PW Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. This bypasses the fix implemented for CVE-2025-57811 patched in 5.8.7. Required Permissions - Administrator permissions or access...
Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget
There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create Twig function combined with a Symfony Process gadget chain. This bypasses the fix implemented for CVE-2025-57811 patched in 5.8.7. Required Permissions - Administrator permissions or access...
PT-2026-22827
Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager versions 2025.3.30 and earlier Description An issue exists in the connection entry component of the software where the 'Disable password saving in vaults' setting is not properly enforced. This allows an...
PT-2026-30181
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.0-rc1-00116-g018018a17770 Description A flaw was discovered in the Linux kernel's mm/rmap subsystem related to the restoration of page table entries PTEs for lazyfree folios. Specifically, when batch unmappin...
PT-2026-22951
Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.9.0-beta.1 Craft versions prior to 4.17.0-beta.1 Description Craft is a content management system CMS. A flaw exists where the "Duplicate" entry action does not properly verify user permissions for specific target...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005474)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005474 advisory. A flaw possibility of memory leak in the Linux kernel cpuentryarea mapping of X86 CPU data to memory was found in the way user can guess location of exception stacks...
GHSA-59G6-V3VG-F7WC CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements
Impact The Doris target connector didn't verify the configured table name before creating some SQL statements ALTER TABLE. So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. Patches Yes, it's fix...
MINI-QRF3-JC36-XFXG
Bulletin has no description...
CGA-83FG-7MMW-C32R
Bulletin has no description...
MINI-RRJW-4HWM-XX5F
Bulletin has no description...
MINI-HX3Q-326V-PPMW
Bulletin has no description...
MINI-848W-2W2G-5C9G
Bulletin has no description...
MINI-RCRJ-8CR8-WP67
Bulletin has no description...
MINI-PJJW-7367-WVVC
Bulletin has no description...
MINI-98J3-93FM-C394
Bulletin has no description...
GHSA-GXCX-QJQP-8VJW
creationtimestamp| type| source ---|---|--- 2026-02-25 01:08:17+00:00| seen| https://gist.github.com/alon710/6e6e6e4c81d80b002d5451729c5d86bb...
CVE-2026-27642
creationtimestamp| type| source ---|---|--- 2026-02-24 01:12:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfkyefyb4j2o...
Cloud Based WAF Upload Scan and Control: The New Standard for File Upload Security
We're excited to announce the launch of Upload Scan and Control, an essential new feature for Imperva Cloud WAF. This add-on tackles one of the most critical vulnerabilities facing web applications today—insecure file uploads—offering protection with scalability, simplicity, and enterprise-grade...