CVE-2026-34182

Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve...

CVE-2026-9076

OpenSSL is vulnerable to a heap out-of-bounds read in the kek_unwrap_key() function during CMS password-based decryption (RFC 3211 / PWRI key unwrap). The flaw occurs because the software fails to enforce a block cipher requirement for the Key Encryption Key (KEK) cipher. An attacker providing a ...

CVE-2016-20063

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to...

CVE-2026-11789

A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication...

CVE-2016-20063 Single Personal Message 1.0.3 WordPress Plugin SQL Injection

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to...

CVE-2016-20063

CVE-2016-20063 affects Single Personal Message 1.0.3 WordPress Plugin. The vulnerability is an SQL injection in the message parameter, exploitable by authenticated users to run arbitrary SQL queries, potentially accessing sensitive database information and site configuration data. Attack vector i...

AZL-90132 CVE-2026-9698 affecting package perl-DBI for versions less than 1.643-5

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a...

EUVD-2026-35359

Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41972

Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability...

ch.artaios:openchemlib-vaadin (>=2.0.0, <=2.4.1), ch.martinelli.oss:vaadin-jooq (2.1.1) +471 more potentially affected by CVE-2026-41715 via io.projectreactor.netty:reactor-netty (>=1.1.0, <=1.1.31)

io.projectreactor.netty:reactor-netty MAVEN version =1.1.0, =2.0.0, =3.1.0.5, =3.3.0.0, =5.0.0, =5.0.0, =1.1.5, =2.0.0, =4.2.0, =4.2.0, =4.9.0-beta.1, =4.9.0-beta.1, =4.9.0-beta.1, =3.0.0, =3.0.1 and more Source cves: CVE-2026-41715 Source advisory: GHSA-PFC9-2CQG-9WQ6...

CVE-2026-41855

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

CVE-2026-41855 Spring Framework Unsafe Deserialization via Jackson JMS Converters

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

EUVD-2026-35344

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

CVE-2026-41855 Spring Framework Unsafe Deserialization via Jackson JMS Converters

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affect...

SUSE CVE-2026-46291

In the Linux kernel, the following vulnerability has been resolved: crypto: caam - guard HMAC key hex dumps in hashdigestkey Use printhexdumpdevel for dumping sensitive HMAC key bytes in hashdigestkey to avoid leaking secrets at runtime when CONFIGDYNAMICDEBUG is enabled...

PT-2026-47763

Name of the Vulnerable Software and Affected Versions Single Personal Message version 1.0.3 Description Authenticated users can execute arbitrary SQL queries by injecting malicious code through the message parameter. This allows attackers to access the admin interface and use crafted SQL statemen...

cve-2026-41714 - MEDIUM - In Spring AMQP the `RabbitConnectionFactoryBean.setUri("amqps://...")` bypasses secure SSL setup, uses `TrustEverythingTrustManager`

cve-2026-41714 - MEDIUM - In Spring AMQP the RabbitConnectionFactoryBean.setUri"amqps://..." bypasses secure SSL setup, uses TrustEverythingTrustManager...

CVE-2016-20063: Improper Neutralization of Special Elements used in an SQL Command

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to...

Huawei HarmonyOS path traversal vulnerability

Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The Huawei HarmonyOS SMS app contains a path traversal vulnerability, which can be exploited by attackers to compromise the system’s...

WordPress plugin: Single Personal Message SQL injection vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blogs on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed to...