EUVD-2026-62628

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

CVE-2026-55703 Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/id and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show renders the record withou...

CVE-2025-14603

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2026-50152

A flaw was found in the MON subscription handler of Ceph, a distributed storage system. The handler does not properly authorize access to the config-key store when processing MMonSubscribe messages. Any CephX user holding mon allow r capabilities can read the entire config-key store, which contai...

CVE-2026-71098

creationtimestamp| type| source ---|---|--- 2026-08-19 17:53:03+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2020-37267

A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. An attacker with access to these logs could obtain the bot's...

CVE-2026-70822

creationtimestamp| type| source ---|---|--- 2026-08-19 17:51:23+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-62536

creationtimestamp| type| source ---|---|--- 2026-08-19 17:49:32+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10...

CVE-2026-71150

creationtimestamp| type| source ---|---|--- 2026-08-19 17:48:35+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-27 01:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtzpju6zgf22...

MINI-XQRQ-FX3V-H5CG

Bulletin has no description...

MINI-88FH-89X6-QC92

Bulletin has no description...

CVE-2026-20359

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20320

A vulnerability in the Open Client Interface OCI XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution...

CVE-2025-14603

vsDesk is vulnerable to blind SQL injection due to insecure handling of user-supplied parameters that are passed directly into SQL queries. An unauthenticated remote attacker can exploit this over the network with low complexity to potentially expose database contents or render the application un...

EUVD-2025-210741

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

EUVD-2026-62590

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure due to the storage of password reset tokens in a publicly accessible tracking file when user tracking is enabled. An attacker can...

Information Exposure

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure due to the storage of password reset tokens in a publicly accessible tracking file when user tracking is enabled. An attacker can...

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the pdf.php endpoint. An attacker can access sensitive metadata, including titles, solution IDs, author names, and last-update...