ColdFusionPwn

ColdFusionPwn Exploitation Tool for CVE-2017-3066 targeting Adobe Coldfusion 11/12. Description The tool allows you to generate serialized AMF-payloads to exploit the missing input validation of allowed classes. For details see our blog post. Install Get the latest version of ysoserial. Get...

CVE-2026-112058

A flaw was found in libdvdnav. An attacker could trigger a Denial of Service DoS by convincing a user to load a specially crafted DVD or disc image. Due to missing input validation in the setPTT function, an invalid title number causes the library to read memory beyond allocated boundaries, leadi...

CVE-2026-109674 Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

CVE-2026-109648 Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying...

CVE-2026-109647

Frappe ERPNext versions before 15.106.0 and 16.x before 16.16.0 are vulnerable to SQL injection across multiple endpoints. The root cause is missing input validation , which allows authenticated attackers to send specially crafted requests. This vulnerability enables the manipulation of database ...

CVE-2026-109646 Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

CVE-2026-109638 Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

CVE-2026-109638

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are vulnerable to a SQL injection flaw in certain endpoints. The root cause is missing input validation , which allows authenticated attackers to submit specially crafted requests to manipulate database queries. This vulnerability ca...

CVE-2025-71432 Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

EUVD-2026-93944

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting XSS. Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting...

Linux Distros Unpatched Vulnerability : CVE-2026-104042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd. A local attacker can cause a Denial of Service DoS by sending a crafted Pluggable Authentication Module PAM request containing a...

[SECURITY] [DSA 6529-1] libwebsockets security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 29, 2026 https://www.debian.org/security/faq -...

Debian dsa-6529 : libwebsockets-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6529 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz...

CVE-2026-82441

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

CVE-2026-89716 zram: validate deflate params

In the Linux kernel, the following vulnerability has been resolved: zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits value is outside of valid ranges...

Linux USB Device Driver Heap Buffer Overflow DoS

The vulnerability of the mxuportcalcnumports function in the drivers/usb/serial/mxuport.c module of the Linux device driver framework is related to the copying of buffers without checking input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

DataEase-Authenticated-SQL-Injection-

DataEase: Authenticated SQL Injection previewData Summar...

Security update for quagga

This update for quagga fixes the following issue: CVE-2026-37458: missing input validation in the MPREACHNLRI component allows authenticated attackers to cause a DoS via a crafted UPDATE message bsc1263974. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE CVE-2026-72294

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Check irq validity in kvmvcpuioctlinterrupt Function kvmvcpuioctlinterrupt can be called from userspace, here add irq validility cheking in kvmvcpuioctlinterrupt...

SUSE-SU-2026:3868-1 Security update for quagga

This update for quagga fixes the following issue: - CVE-2026-37458: missing input validation in the MPREACHNLRI component allows authenticated attackers to cause a DoS via a crafted UPDATE message bsc1263974...