EUVD-2026-77458

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector...

CVE-2026-90934 EspoCRM before 10.0.4 Field-level Security Bypass via Attendees

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...

CVE-2026-90934

EspoCRM before 10.0.4 is affected by a field-level security bypass in the meeting and call attendees endpoints. The root cause is incorrect ACL scope validation that checks parent event permissions instead of attendee entity permissions, allowing authenticated users to recover restricted email ad...

EUVD-2024-55764

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

CVE-2024-58383 Froxlor before 2.2.0 Insecure File Permissions mysql.conf

Froxlor before 2.2.0 affected up to and including 2.2.0-rc3 generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable the...

Astra Linux – Vulnerability in Zabbix

Setting the SMS media allows for setting the GSM modem file. This file is later used as a Linux device. But since everything is a file for Linux, it’s possible to set another file, such as a log file. In this case, Zabbixserver will attempt to communicate with it as a modem. As a result, the log...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1, Linux-5.10

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections support pairing in Bluetooth Core Specification 4.2 through 5.4. However, these devices are vulnerable to certain man-in-the-middle attacks, which force the use of a short key length. This vulnerability may lead to the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15, and Linux 6.1

An integer overflow flaw was discovered in the Linux kernel. This issue causes the kernel to allocate skbsharedinfo in the user space, which can be exploited in systems without SMAP protection, as skbsharedinfo contains references to function pointers...

Astra Linux – Vulnerability in Samba

A flaw was discovered in Samba. Some SMB1 write requests were not properly range-checked to ensure that the client had sent enough data to complete the write operation. As a result, the contents of the server’s memory were written to the file or printer, rather than the data provided by the clien...

CVE-2026-77883 Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's if...

CVE-2026-78336

Apache Syncope suffers from an information disclosure flaw in its OIDC SSO provider listing endpoint. Any authenticated user can query the list of available OIDC providers configured for SSO (Console and Enduser); the returned payload includes all configuration settings, including client secrets ...

Astra Linux – Vulnerability in exim4

Exim 4 before 4.94.2 allows exposure of file descriptors to an unintended control sphere, because rdainterpret uses a privileged pipe without the closeonexec flag...

Astra Linux – Vulnerability in Inkscape

Inkscape version 0.91 has a vulnerability where an uninitialized pointer exists, which may allow an attacker to access unauthorized information...

Astra Linux – Vulnerability in Twisted

Twisted is an event-driven networking engine written in Python. In affected versions, Twisted exposes cookies and authorization headers when performing cross-origin redirects. This issue is present in the twited.web.RedirectAgent and twisted.web.BrowserLikeRedirectAgent functions. Users are advis...

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2 A critical RCE vulnerability in MCPJam Inspector 3.Start the exploit root@kitploit: python3 CVE-2026-23744.py -u -i -p 4.For better usage I recomend to update the terminal to a fully funcional one , otherwise u wont be able to use commands like ctrl^...

postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator

A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain...

CVE-2026-90895

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...

POC_CVE-2026-42880

CVE-2026-42880 — ArgoCD Secret Exposure via ServerSideDiff A lab environment for reproducing and detecting CVE-2026-42880 , a critical vulnerability in Argo CD where the ServerSideDiff gRPC handler exposes Kubernetes Secret data to read-only users. Vulnerability Overview...

CVE-2026-90895 MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from the web application in multiple security-sensitive areas: - feed listings did...

CVE-2026-90895

MISP's interactive CLI shell (versions ≤2.5.45) implemented access control independently from the main web application, creating several authorization bypass gaps. Feed listings skipped lookup_visible restrictions for non-host-organisation users, feed detail access bypassed host-organisation/site...