CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

PT-2026-66722

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...

EUVD-2025-210575

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

CVE-2025-69948

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection due to improper neutralization of special elements used in an SQL command. The flaw exists at the /admin/delete_group.php endpoint, specifically via the id parameter. Attackers can insert malicious SQL statements into...

CVE-2026-67594

Summary (CVE-2026-67594): Spikster (commit e1cdf8c) contains a missing authentication flaw in the API route group due to the CipiAuth middleware being registered but never applied. This allows unauthenticated remote attackers to access approximately 50 API endpoints, enabling enumeration and prov...

LDAP Injection

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to LDAP Injection through the...

CVE-2026-14227

The CVE-2026-14227 entry describes an API session-management vulnerability in MikroTik RouterOS when the API is enabled. The flaw allows an active session to retain its previous permission set after inactivity timeouts or user-group changes, meaning an authenticated user whose permissions have be...

SUSE CVE-2026-42590

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix...

SUSE CVE-2026-44315

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can create, read, and delete PFD-management transaction state with a...

SUSE CVE-2026-44320

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-callback route group without inbound OAuth2/bearer-token authorization. A forged or arbitrary bearer token e.g. Authorization: Bearer not-a-real-token is enough to reach the SMF-callback...

SUSE CVE-2026-44327

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the OAM route with no Authorization header at all and the handl...

SUSE CVE-2026-55653

A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange DH-GEX client path. This occurs during FIPS Federal Information Processing Standards mode known-group validation when the client processes attacker-controlled DH-GEX...

SUSE CVE-2026-64556

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

CVE-2026-58222

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

EUVD-2026-51161

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory...

CVE-2026-44616 Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction

LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint and potentially expose directory...

CVE-2026-58222

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

EUVD-2026-51158

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

CVE-2026-58222 Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...