CVE-2026-56093 Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...

Apache Log4j2 - Remote Code Injection

Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. id: CVE-2021-45046 info: name: Apache Log4j2 - Remote Code Injection author: ImNightmaree severity: critical description: Apache Log4j2 Thread Context Lookup Pattern is...

SUSE CVE-2026-77413

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

PT-2026-81855

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users view ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

The vulnerability of the lookup() function in the child_process module of the json-data transformation software JSONata allows a attacker to execute arbitrary code.

The vulnerability of the lookup function in the childprocess module of the json-data transformation software JSONata is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-81222

The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...

CVE-2026-56093: Authorization Bypass Through User-Controlled Key

The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...

The vulnerability of the environment.lookup() function in the child_process module of the json-data processing tool, JSONata, allows a attacker to execute arbitrary code.

The vulnerability of the environment.lookup function in the childprocess module of the json-data processing tool JSONata is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind...

Server-side Request Forgery (SSRF)

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Proper mmstruct should be used in inuprobetrampoline. In the unregistered path, we use inuprobetrampoline to check the VMA lookup using current-mm, which is incorrect. This is because we are in the tracer context, no...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups The icssgndogetstats64 function emacgetstatbyname, using FW PA stat names, regardless of whether the PA stats block is present on the hardware. emacgetstatbyname already guards the ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: vduse: It is necessary to hold the vduselock during the IDR lookup in the open path. The vdusedevopen function looks up the struct vdusedev through the IDR, and then acquires dev-lock only after the vduselock has been released...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ntfs: Moving the resident index root entries into an index block before updating the parent header. The ntfsirreparent function moves the resident index root entries into an index block and leaves a small root stub containing the...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: L2CAP: fixed the “bad unlock balance” issue in l2capdisconnectrsp. The conn-chanlock is not acquired before l2capgetchanbyscid. If l2capgetchanbyscid returns NULL, then the “bad unlock balance” issue will be trigger...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftlookup: fix handling of catchall elements with inverted lookups nftlookupeval determines whether a lookup matches found from the direct set lookup and priv-invert before falling back to the catchall element used ...

SUSE CVE-2026-74664

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

SUSE CVE-2026-72320

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...