CVE-2025-50565

CVE-2025-50565 Description Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. Vulnerability Type SQL Injection Attack Type Remote Impact Information Disclosure true Has vendor confirmed true Discoverer...

USN-8931-1: Apache HTTP Server vulnerabilities

이지웅 discovered that Apache HTTP Server exposed WebDAV property information. A remote attacker could possibly use this issue to obtain sensitive information. CVE-2026-58415 Zhen Kong and Charles Vosburgh discovered that Apache HTTP Server did not properly validate FTP server responses. A remote...

CVE-2026-102944

The cpp-httplib C++ header-only HTTP/HTTPS library is vulnerable to Cookie header leakage during cross-origin redirects. Prior to version 0.51.0 , the create_redirect_client() function fails to remove Cookie headers when following 301, 302, 307, or 308 redirect codes, unlike Host, Proxy-Authoriza...

WordPress Elementor Website Builder – more than just a page builder plugin <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Or Benit in WordPress Plugin Elementor Website Builder versions = 4.2.3...

CVE-2026-54554

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-110777

A flaw in evolution-data-server allows for local file disclosure. When a user saves a calendar event containing a file:// URI in its ATTACH property, the application automatically reads the targeted local file, encodes the content in base64, and uploads it to the server. Because there are no file...

CVE-2026-66822

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of us...

EUVD-2026-101520

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554

The FOG open-source cloning and imaging suite is vulnerable in versions prior to 1.5.10.1870 . The adInfo() endpoint in packages/web/lib/fog/fogpage.class.php can be accessed without an authenticated session via node=ipxe. This flaw allows a remote unauthenticated requester to obtain the FOG_AD_D...

CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-77371

The Redash data visualization package versions 26.0.0 through 26.9.0 are vulnerable due to a misconfiguration in the DuckDB query runner located at redash/query_runner/duckdb.py. The _connect() path fails to disable enable_external_access , leaving it at its default value of true. A user with que...

CVE-2026-86845

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend...

CVE-2026-86848

A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend...

CVE-2026-77564

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking...

DEBIAN-CVE-2026-67418

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated...

CVE-2026-102085

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, a process whi...

CVE-2026-101965

An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause telemetry-service disruption, information disclosure, or potential root-level code execution via a crafted message to the gNMI...

CVE-2026-102056

Juniper Networks Junos OS and Junos OS Evolved are affected by an Out-of-bounds Read vulnerability in the cfmd process . An unauthenticated attacker on an adjacent network can crash the daemon and disclose limited process memory by sending a specific CFM Message to a configured interface. Informa...