23934 matches found
RHSA-2026:0233
creationtimestamp| type| source ---|---|--- 2026-01-08 07:58:01+00:00| seen| https://gist.github.com/Darkcrai86/fbdf20b19e12fdac7917ef429b8a06b9...
RHSA-2026:0237
creationtimestamp| type| source ---|---|--- 2026-01-08 07:57:35+00:00| seen| https://gist.github.com/Darkcrai86/da7e4d18ae3b88e2895c98c0d51ae1b2...
CVE-2025-13679 Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getorderbyid function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with...
kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
A flaw was discovered in the Bluetooth subsystem of the Linux kernel. When processing a HCIEVNUMCOMPPKTS event, the function hciconntxdequeue did not properly hold or release the hdev device lock, which may lead to a use-after-free of the connection structure...
PT-2026-2174
Name of the Vulnerable Software and Affected Versions OPEXUS eCASE Audit versions prior to 11.14.2.0 Description OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the “A or SIC Number” field within the Project Setup functionality. This JavaScript is executed when another...
PT-2026-37606
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the GHES/CPER logic of the Linux kernel regarding the handling of ARM processor CPER records. The system fails to detect when the section length is excessively large. ...
EUVD-2026-1451
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user'...
CVE-2026-22232: Improper Neutralization of Input During Web Page Generation
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0...
EUVD-2026-1172
An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker...
CVE-2026-22544
creationtimestamp| type| source ---|---|--- 2026-01-07 18:07:02+00:00| seen| Telegram/BnTAIC0iodkqMq4D8miTs1BNlTWY2vPbrNPo5ViH8Dm-XRI 2026-01-07 18:12:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbu2xpqw3m2u...
EUVD-2026-1175
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39...
EUVD-2026-1203
The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions...
EUVD-2026-1198
An attacker with a network connection could detect credentials in clear text...
EUVD-2026-1208
The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly...
CGA-P8WC-28G2-VQM9
Bulletin has no description...
EUVD-2026-1225
Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02...
EUVD-2026-1223
Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7...
EUVD-2026-1234
Not used...