EUVD-2026-13109

An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function...

CLSA-2026-1773927217 expat: Fix of CVE-2026-25210

CVE-2026-25210: fix integer overflow in tag buffer reallocation in doContent function...

CLSA-2026-1773926416 expat: Fix of CVE-2026-25210

CVE-2026-25210: fix integer overflow in tag buffer reallocation in doContent function...

Missing Authentication for Critical Function

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the decryptMessage.json.php endpoint, which processes user-supplied private keys, encrypted messages, and...

Missing Authentication for Critical Function

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in WordNet Browser HTTP server in default configuration. An attacker can cause the service to...

fs: ntfs3: check return value of indx_find to avoid infinite loop

...

EUVD-2025-208848

A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the intended extractio...

SUSE CVE-2026-23256

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in VF setupnicdevices cleanup In setupnicdevices, the initialization loop jumps to the label setupnicdevfree on failure. The current cleanup loop whilei-- skip the failing index i, causing a...

CVE-2026-30403

CVE-2026-30403 affects wgcloud before 3.6.3, where the vulnerable area is the test connection function in the backend database management module. The issue allows an attacker to perform an arbitrary file read on the victim’s server, exposing sensitive files. The description and connected sources ...

SuiteCRM SQL注入漏洞

SuiteCRM is a customer relationship management system developed by the SuiteCRM team. Versions of SuiteCRM prior to 7.15.1 and 8.9.3 had an SQL injection vulnerability. This vulnerability stemmed from the retrieve function in the include/OutboundEmail/OutboundEmail.php file, which failed to...

ROS-20260319-73-0017

A vulnerability in the normalexit function of the Grub2 operating system boot loader is related to the dereferencing of an expired pointer. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2026-30402

CVE-2026-30402 affects wgcloud v2.3.7 and earlier. A remote attacker can execute arbitrary code via the test connection function, per CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8). No remediation details are provided in the supplied documents.

CVE-2026-30403

There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read any file on the victim's server...

PT-2026-26437

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the retrieve function in include/OutboundEmail/OutboundEmail.php fails to properly neutralize the user controlled $id parameter. It is assumed that the...

CVE-2026-30402

An issue in wgcloud v.2.3.7 and before allows a remote attacker to execute arbitrary code via the test connection function...

CVE-2026-30403

There is an arbitrary file read vulnerability in the test connection function of backend database management in wgcloud v3.6.3 and before, which can be used to read any file on the victim's server...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system developed by the SuiteCRM team. Versions prior to SuiteCRM 7.15.1 and 8.9.3 contained security vulnerabilities. These vulnerabilities stemmed from the actionexportCustom function in modules/ModuleBuilder/controller.php, which failed to properl...

PT-2026-26475

Summary The setPassword.json.php endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before...

wgcloud 安全漏洞

wgcloud is a lightweight distributed server monitoring and operation system developed by tianshiyeben as an individual developer. Versions of wgcloud prior to 2.3.7 contain security vulnerabilities. These vulnerabilities stem from defects in the test connection function, which may allow for remot...

The vulnerability of the bio_poll() function in the block/blk-core.c module, which supports the block-level kernel in the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the biopoll function in the block/blk-core.c module, which supports the block-level kernel in the Linux operating system, is related to the pointer dereferencing due to poor synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...