[SECURITY] [DSA 6112-1] openjdk-21 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6112-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 27, 2026 https://www.debian.org/security/faq -...

CVE-2025-70368

Worklenz version 2.1.5 contains a Stored Cross-Site Scripting XSS vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. Malicious JavaScript may be executed in a...

SUSE CVE-2026-23511

ZITADEL is an open source identity management platform. Prior to 4.9.1 and 3.4.6, a user enumeration vulnerability has been discovered in Zitadel's login interfaces. An unauthenticated attacker can exploit this flaw to confirm the existence of valid user accounts by iterating through usernames an...

PT-2026-4861

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource third party/faad2-2.7/libfaad modules. This vulnerability is associated with program files bits.C, syntax.C. This issue affects anyRTC-RTMP-OpenSource: before 1.0...

Victor CMS code-related vulnerabilities

Victor CMS is an open-source content management system developed by Victor Alagwu in Nigeria. Version 1.0 of Victor CMS has code-related vulnerabilities; these vulnerabilities stem from defects in the file upload functionality, which may lead to the upload and execution of malicious PHP files...

Knock Subdomain Scan security vulnerability

Knock Subdomain Scan is a domain name scanning tool developed by Gianni Amato. Version 4.1.1 of Knock Subdomain Scan contains a security vulnerability, which stems from unfiltered server headers, potentially allowing for CSV injection attacks...

CVE-2025-69559

code-projects Computer Book Store 1.0 is vulnerable to File Upload in adminadd.php...

Debian dsa-6112 : openjdk-21-dbg - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6112 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6112-1 [email protected] https://www.debian.org/securit...

SGH SQL injection vulnerability

SGH is a loan fund management PHP script developed by Geraked. Version 0.1.0 of SGH contains an SQL injection vulnerability, which arises from improper handling of the id parameter in the management interface. This vulnerability may lead to SQL injection attacks...

The allocate_structures function insufficiently checks bounds before arithmetic multiplication

sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocatestructures contains a sizet overflow in sacommon.c. The allocatestructures function insufficiently checks bounds before arithmetic...

OATH Toolkit 2.6.14

OATH Toolkit attempts to collect several tools that are useful when deploying technologies related to OATH, such as HOTP one-time passwords. It is a fork of the earlier HOTP Toolkit...

Code-Projects Mobile Shop Management System security vulnerabilities

Code-Projects Mobile Shop Management System is an open-source mobile store management system developed by Code-Projects. Version 1.0 of the Code-Projects Mobile Shop Management System contains a security vulnerability. This vulnerability stems from improper handling of the Password parameter in t...

CVE-2025-15469

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

UBUNTU-CVE-2025-15469

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

EUVD-2026-4679

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be expose...

Apache bRPC 1.14.0 Exposure / Misconfiguration Checker

Apache bRPC versions 1.14.0 and below exposure and misconfiguration audit tool that does not exploit CVE-2025-60021 but rather validates unsafe exposure conditions that can lead to it...

Embracing Choice in Cybersecurity: TrendAI Vision One™ and SentinelOne Integration

Discover how the TrendAI Vision One and SentinelOne integration exemplifies our commitment to endpoint flexibility...

POC-Generator-Burp_Suite_Extension

🎯 POC Generator - Burp Suite Extension From vulnerability...

CVE-2020-36932 Seacms 11.1 - 'checkuser' Stored XSS

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...

CVE-2026-1088

The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the devotionloginformprocess AJAX action. This makes it possible for unauthenticated attackers to update the plugin's login...