CVE-2026-95674 MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

CVE-2026-95674

This vulnerability affects MISP (a threat intelligence platform), specifically the queryEnrichment method in EventsController.php. The root cause is a missing validation check: when a caller specified a module name not present in the instance's enabled modules list, the code silently continued pr...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

CVE-2026-95658

CVE-2026-95658 affects MISP , where the moduleStatelessExecution action in the WorkflowsController was listed in the CakePHP Security component's unlockedActions list, disabling both the CSRF token check and field hash validation . An attacker could craft a cross-site form post that, when submitt...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

CVE-2026-43643: Missing Authorization

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

PT-2026-96728

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description The queryEnrichment function in EventsController.php fails to properly validate the module name parameter. When a module name is provided that is not in the list of enabled modules, the system...

The vulnerability of the os and dns modules in the vm2 package manager NPM allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the os and dns modules in the vm2 package manager NPM is related to errors in information processing. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information...

PT-2026-96661

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.22 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the dslc module downloads output shortcode content...

PT-2026-97117

Name of the Vulnerable Software and Affected Versions itsourcecode Leave Management System version 1.0 Description A remote SQL injection exists in the /module/leavetype/index.php endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL command...

PT-2026-96921

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description A PHP object injection issue exists in the billing module handler. Unauthenticated remote attackers can provide arbitrary serialized PHP...

CVE-2026-95674: Improper Input Validation

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

PT-2026-96922

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description An authorization bypass exists in the billing module handler. Unauthenticated remote attackers can modify any tenant's account balance by...

CVE-2026-43641: Improper Neutralization of Special Elements used in an OS Command

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can...

CVE-2026-43642: Deserialization of Untrusted Data

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freeradius (UTSA-2026-090267)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090267 advisory. In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BNCTX instance to handle all handshakes. This mean multiple threads use the same BNCTX...

PT-2026-105968

stack graphs::c is a public module. From 0.0.3 through the current crates.io release 0.14.1, its pointer-taking entry points are pub extern "C" fn rather than unsafe fn. Safe Rust can call them. sg stack graph free frees the pointer with Box::from raw. sg stack graph freestd::ptr::null mut is...

PT-2026-96920

Name of the Vulnerable Software and Affected Versions Softaculous Virtualizor versions prior to 3.2.9 Patch 9 Softaculous Virtualizor version 3.0.0 Description An OS command injection exists in the billing module handler. Unauthenticated remote attackers can bypass authentication using specific...

RockyLinux 10 : rsyslog (RLSA-2026:67584)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67584 advisory. rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd CVE-2026-19654...