CVE-2026-53448

Coturn’s CVE-2026-53448 concerns the HTTPS admin panel, where prior to 4.12.0 HTTP query parameters were interpolated into SQL queries without sanitization. The is_secure_string filter guarding the STUN path is not applied to admin panel operations delete-user, delete-secret, and delete-IP, allow...

EUVD-2026-42965

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not...

CVE-2026-2397 SQLi in AdamPOS' MobilMen 20T

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not...

EUVD-2026-42937

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with ...

PYSEC-2026-3443

Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...

patchtriage

PatchTriage !CIhttps://github.com/d01ki/patchtriage/actio...

CVE-2026-56689

Dell PowerFlex Manager, Version prior to 5.1.0.1, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

OPENSUSE-SU-2026:21281-1 Security update for cosign

This update for cosign fixes the following issues - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: multiple issues when parsing HTML files bsc1267044. - CVE-2026-33815: memory-safety vulnerability bsc1261811. -...

K000162182: Spring Expression Language (SpEL) vulnerability CVE-2026-41850

Security Advisory Description Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading...

EUVD-2026-42840

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' parameter in all versions up to, and including, 4.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-15104

Summary: CVE-2026-15104 affects the WordPress plugin “BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot” up to version 4.6.0. The vulnerability is a generic SQL Injection via the ‘lang’ parameter, caused by insufficient escaping of user input and lack of proper preparat...

CVE-2026-40454 Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data

Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users...

CVE-2026-40007

CVE-2026-40007 affects Apache IoTDB. The issue is an uncontrolled recursion in the AirGap receiver: when pipe_air_gap_receiver_enabled is true, readLength recursively processes E-language prefixes with no depth limit, allowing an unauthenticated attacker to exhaust the receiver thread’s JVM stack...

ROS-20260710-73-0032

The vulnerability of the Go programming language is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a perpetrator to cause service failures...

ROS-20260710-73-0028

The vulnerability of the html/template module in the Go programming language is related to the lack of measures taken to protect web page structures. Exploiting this vulnerability allows attackers who operate remotely to perform cross-site scripting attacks XSS...

ROS-20260710-73-0026

The vulnerability of the Go programming language is related to shortcomings in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the confidentiality and integrity of the protected information...

ROS-20260710-73-0034

The vulnerability of the Go programming language is related to incorrect encoding or escaping of output data when processing the tag’s type attribute. Exploiting this vulnerability can allow an attacker to gain read and modify access to data remotely...

ROS-20260710-73-0030

The vulnerability of the Go programming language’s crypto/x509 component is related to the lack of input validation for cyclic operations. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

ROS-20260710-73-0004

The vulnerability of the url.Parse function in the host/authority component of the Go programming language is related to improper syntax validation of input. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

ROS-20260710-73-0015

The vulnerability of the Go programming language’s MIME component is related to its algorithmic complexity. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using a specially created MIME header...