Astra Linux – Vulnerability in cups

Due to a failure in validating the length provided by a PPD PostScript document crafted by an attacker, CUPS and libppd are vulnerable to a heap-based buffer overflow, potentially leading to code execution. This issue has been fixed in CUPS version 2.4.7, released in September 2023...

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Impact A SQL injection vulnerability exists in the Query Builder's deleteBatch method. When deleteBatch is used together with where conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quote...

EUVD-2026-51396

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...

CVE-2026-14936

The CVE concerns the Simple Membership WordPress plugin prior to version 4.7.7, where PayPal IPN verification is not performed against the site’s configured merchant account before activating a membership. This allows unauthenticated users to activate or extend memberships using PayPal payments t...

CVE-2026-66712

CVE-2026-66712 affects the WordPress plugin Simple Membership versions

CVE-2026-66712

Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...

CLSA-2026-1782435546 TuxCare security update for handlebars (8 CVEs)

TuxCare rebuilt handlebars to address 8 CVEs. Fixed in 4.7.8-tuxcare.1...

CLSA-2026-1776991069 TuxCare security update for handlebars (9 CVEs)

TuxCare rebuilt handlebars to address 9 CVEs. Fixed in 4.7.9-tuxcare.1...

CLSA-2026-1770250308 TuxCare security update for celery (1 CVE)

TuxCare rebuilt celery to address 1 CVE. Fixed in 4.4.7.post1+tuxcare...

Say Hello to Agent Insta: Closing the Detection Gap in Exposure Management at Machine Speed

Executive Summary Frontier AI has turned CVE weaponization timelines to hours, making scan-bound detection a growing compliance and breach-risk challenge. Agent Insta powers InstaScan to deliver scanless detection by transforming existing inventory, telemetry, and threat intelligence into validat...

Exploit for CVE-2025-48932

CVE-2025-48932-Invision-Community-SQLi-Exploit CVE-2025-48932...

SQL Injection

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to SQL Injection in the deleteBatch process when used with where conditions. An attacker can execute arbitrary SQL commands by supplying...

CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

UBUNTU-CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63223 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

BELL-CVE-2026-64476

Bulletin has no description...

CVE-2026-59551

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59549

Affected software: WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.10). Vulnerability: Unauthenticated SQL Injection. Root cause/impact: SQL injection that does not require authentication; CVSS metrics in the external record indicate high confidentiality impact ...