323622 matches found
CVE-2026-77846
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...
CVE-2026-77846
ash-project ash_sqlite versions from 0.1.2-rc.0 before 0.2.18 contain a JSON-path injection in AshSqlite.SqlImplementation. The json_extract path is built by concatenating "$." with Enum.join(right, "."), so a single get_path/2 segment containing ., [, ], or $ re-interprets the JSON path (e.g., "...
CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...
EUVD-2026-68139
A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /studentedit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been...
CVE-2026-77970 Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists. sensitiveattributes :redact and :ignore only act on the track...
CVE-2026-77970 Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
Cleartext Storage of Sensitive Information vulnerability in ash-project ashpapertrail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists. sensitiveattributes :redact and :ignore only act on the track...
PT-2026-83584
Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.12 Description Broken access control in profile function.php allows authenticated users with low privileges to view the future role memberships of other users. This is achieved by bypassing profile-level...
PT-2026-83586
A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...
PT-2026-83629
Name of the Vulnerable Software and Affected Versions ash graphql versions 1.9.0 through 1.10.x Description A remote client can read internal field names that an application configured its error handler to redact. In AshGraphql.Errors, errors are processed by the error handler and merged using...
PT-2026-83625
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...
PT-2026-83578
SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...
Debian dsa-6479 : roundcube - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6479 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6479-1 [email protected] https://www.debian.org/securit...
PT-2026-83627
Incorrect Authorization vulnerability in ash-project ash graphql delivers GraphQL subscription payloads for records a subscriber is not authorized to see. In AshGraphql.Subscription.Batcher, do send/5 resolves the first notification of a batch and filters it with should send?/1, which drops resul...
CVE-2026-82424
PHPGurukul Student Information System 1.0 contains a SQL injection vulnerability in the file /student_edit1.php , triggered by manipulating the ID argument. The attack can be launched remotely with low privileges and no user interaction. The exploit has been made publicly available as a proof-of-...
CVE-2026-82424 PHPGurukul Student Information System student_edit1.php sql injection
A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /studentedit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been...
CVE-2026-82424 PHPGurukul Student Information System student_edit1.php sql injection
A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /studentedit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been...
[SECURITY] [DSA 6477-1] linux security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6477-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 29, 2026 https://www.debian.org/security/faq -...
CVE-2026-48273
creationtimestamp| type| source ---|---|--- 2026-08-29 20:00:05+00:00| seen| https://t.me/CyberDispatch/2538 2026-08-30 00:00:38+00:00| seen| https://t.me/CyberDispatch/2538 2026-09-08 22:11:18+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv223t264x2j 2026-09-09 11:50:04+00:00...
CVE-2026-75807
creationtimestamp| type| source ---|---|--- 2026-08-29 18:34:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/54gcvu6ie4sg6 2026-08-30 01:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mub6vmbfl42r...