Dotnetnuke < 10.3.3 Permission precedence flaw in module permissions (GHSA-hqgc-qj63-mx24)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A permission evaluation flaw could allow users with page-level content permissions to access module management features despite...

Important: nginx:1.26 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial o...

Dotnetnuke < 13.3.3 Stored XSS potentially leading to host privilege escalation (GHSA-38xj-rgg3-5cjj)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 13.3.3. It is, therefore, affected by a vulnerability. - A stored cross-site scripting XSS vulnerability in the Console module could allow a Portal Administrator to execute arbitrary...

RHEL 9 : nginx:1.26 (RHSA-2026:59496)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59496 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage...

RockyLinux 9 : nginx:1.24 (RLSA-2026:59490)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59490 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service...

Dotnetnuke < 10.3.3 Unauthorized comments on private journal posts (GHSA-86mr-4mmw-j9g2)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - An authorization vulnerability in the Journal module could allow an authenticated user to add comments to private journal posts...

AlmaLinux 10 : nginx (ALSA-2026:59220)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:59220 advisory. nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 nginx: NGINX: Memory disclosure and denial of service...

nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...

Remote Code Execution (RCE)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions, CustomResolver.isPathAllowed, and...

Remote Code Execution (RCE)

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions,...

CVE-2026-72714

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2020-37268

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...

CVE-2026-72714

Rocq Prover (through 9.2.0) contains a state desynchronization in its universe checking mechanism. When a module that locally disabled the universe checking flag is closed, the global flag is restored but the universe graph retains its own copy left disabled . The kernel then accepts universe-inc...

EUVD-2026-65143

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2026-72714 Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled the check is closed. Local Unset Universe Checking inside a module is expected to last only until the module ends, and the global flag is restored, but the universe graph keeps...

CVE-2020-37268

Coq and Rocq provers are affected by a soundness flaw in the Print Assumptions audit command. When a definition is created with universe checking disabled and later inlined via Parameter Inline in a module type, the inlining drops the record of the unsafe operation. The resulting constant carries...

EUVD-2020-31263

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built...