EUVD-2025-210534

https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activatecase.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activatecase.php in parameter id...

CVE-2026-64320

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

PT-2026-66516

A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWik...

PT-2026-66592

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parse browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted...

PT-2026-66639

Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmem last, rmem end, rmem owner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...

PT-2026-66492

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...

PT-2026-66499

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN TOKEN is unset, allowing unauthenticated attackers to modify GCP...

PT-2026-66452

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...

PT-2026-66498

Julep contains an insecure direct object reference vulnerability in the get execution details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution id values to retrieve sensitive execution records including task inputs,...

Siemens SIMATIC S7-1200 Observable Discrepancy (CVE-2023-37482)

The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames. The login functionality of the web server in affected devices does not normalize the response times of login attempts. An...

PT-2026-66646

Summary is url safe in v1.0.3 contains an SSRF bypass. remove at symbol in string is applied to the raw URL string before new URL parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked. Vulnerability In helpers.ts, is url safe doe...

Siemens SIMATIC S7-1200 Improper Verification of Source of a Communication Channel (CVE-2025-40820)

Multiple Industrial products are affected by a vulnerability in the Interniche IP-Stack. The affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere...

PT-2026-66602

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time entries and GET /api/v3/cost entries rendered links.workPackage.title and links.workPackage.href through associated resource in modules/costs/lib/api/v3/time entries/time entry representer.rb and...

B&R Automation X20EDS410 Multiple Releases of Same Resource or Handle (CVE-2026-43494)

The Linux kernel version shipped with the affected B&R product X20EDS410 is affected by a vulnerability. A flaw in the kernel's net/rds zerocopy path that fails to reset opnents, leading to a double free. Successful local exploitation of this vulnerability could allow an authenticated attacker wi...

PT-2026-66607

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET / locale/thank-you PageRedirectController::thankYouAction and GET / locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderI...

B&R Automation X20EDS410 Incorrect Resource Transfer Between Spheres (CVE-2026-31431)

The Linux kernel version shipped with the affected B&R product X20EDS410 is affected by a vulnerability. A flaw in the kernel's crypto algifaead in-place operation handling. Successful local exploitation of this vulnerability could allow an authenticated attacker with low privileges to escalate...

PT-2026-66574

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options without checking visiblecurrent user, so authenticated non-admin users cou...

PT-2026-66544

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file get contents in the Blueprints::import method without path validation. Attackers can...

PT-2026-66474

Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the d shorthand, which on a character string matches the whole Unicode decimal digit property pNd and not...

Linux Distros Unpatched Vulnerability : CVE-2026-18369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects...