CVE-2026-71150

creationtimestamp| type| source ---|---|--- 2026-08-19 17:48:35+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 01:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtzpju6zgf22...

MINI-XQRQ-FX3V-H5CG

Bulletin has no description...

MINI-88FH-89X6-QC92

Bulletin has no description...

CVE-2026-20320

A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...

CVE-2026-20359

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2025-14603

vsDesk is vulnerable to blind SQL injection due to insecure handling of user-supplied parameters that are passed directly into SQL queries. An unauthenticated remote attacker can exploit this over the network with low complexity to potentially expose database contents or render the application un...

EUVD-2025-210741

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

EUVD-2026-62590

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

CVE-2026-71010

creationtimestamp| type| source ---|---|--- 2026-08-19 16:49:09+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-70731

creationtimestamp| type| source ---|---|--- 2026-08-19 16:46:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

MINI-GXX7-HPF5-QJFJ

Bulletin has no description...

CVE-2026-63408

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-62673

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

MINI-67CW-JG4R-PMPG

Bulletin has no description...

CVE-2026-16019

creationtimestamp| type| source ---|---|--- 2026-08-19 16:08:05+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mth4hvptjp2m 2026-08-19 16:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mth4lhxgtt25...

CVE-2026-63408

In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...

EUVD-2026-62547

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-62673

Grav (file-based web platform) prior to 2.0.4 contains a case-sensitivity flaw in its default .htaccess and webserver-configs/htaccess.txt. Three Apache RewriteRule directives that block access to sensitive file types (.yaml, .php, .json, etc.) under user/ and system/vendor/ omit the [NC] flag, m...