ROOT-OS-DEBIAN-13-CVE-2025-68174 CVE-2025-68174 in linux - Patched by Root

Root has patched CVE-2025-68174 in the linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-111637

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

CVE-2026-111637 NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

CVE-2026-111637

NexoPOS versions through 6.2.4 are vulnerable to an unauthenticated transaction disclosure flaw via the /api/fields/{resource}/{identifier} endpoint. The root cause is a missing authentication vulnerability where attackers can bypass the nexopos.read.transactions permission. By requesting transac...

EUVD-2026-103059

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

CVE-2026-111637 NexoPOS through 6.2.4 Unauthenticated Transaction Disclosure via /api/fields Endpoint

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

PT-2026-116036

NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/resource/identifier. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve...

PT-2026-115890

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

Red Hat: CVE-2026-86047: mariadb: mariadb: SQL injection via improper identifier quoting

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...

zotlit-PoC

ZotLit: security advisory CVE status: requested, pending assignment. This finding is published as GHSA-4qh7-66xv-h329. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-zotlit-PoC and this banner is replaced with the CVE link. | ---|--- Researcher| Dostxodjayev Abdullox @squeeze440...

GoBfuscator

🛡️ GoBfuscator - Advanced Go Code Obfuscation Tool 🔍 Overview GoBfuscator is a professional-grade obfuscation tool specifically designed for Go Golang source code. It provides multiple layers of protection to make reverse engineering difficult while maintaining 100% runtime functionality. Key...

EUVD-2026-102191

Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload and PhotoPolicy::canDownload without first enforcing AlbumPolicy::canAccess. For a public, password-protected album with grantsdownload enabled...

CVE-2026-75505

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Ice: The code for copying the last block was omitted in icegetmoduleeeprom. icegetmoduleeeprom is broken since the commit e9c9692c8a81 “Ice: Reimplement module reads used by ethtool”. In this refactoring, icegetmoduleeeprom reads...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: SCTP: The initialization of additional fields in sctpv6fromsk was incorrect, leading to undefined behavior. SYZbot discovered that sin6scopeid was not properly initialized, causing undefined behavior. sin6scopeid and...

Astra Linux – Vulnerability in sudo

In Sudo version 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a non-existent user by executing sudo with a numerical UID that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability, as executing a command via sudo a...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Do not allow CHAINID to refer to another table. When performing lookups for chains within the same batch using their IDs, a chain from a different table can be utilized. If a rule is added to a table but refe...

EUVD-2026-102111

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

SummaryWhen an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...

PYSEC-2026-4282 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Summary When an application using Pydantic AI opts a URL into local network access — either a FileUrl with forcedownload='allow-local', or webfetchtoolallowlocalurls=True — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address for example...