PT-2026-82262

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-75325

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-75333

The software yx-image-recognition v1.0 is vulnerable to a Path Traversal flaw. The root cause is that the parameters dir and filePath are passed directly to the new File() function for file system operations without any path sanitization or whitelist validation . This allows an attacker to access...

CVE-2026-75333

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

BIT-KEYCLOAK-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

EEF-CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Summary Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthenticatio...

CVE-2026-67578

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

CVE-2026-56705 Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

JetBrains TeamCity < 2020.1.5 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.5. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. CVE-2020-27628 - In JetBrains TeamCity before 2020.1.5, secure dependen...

PT-2026-81194

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters...

JetBrains TeamCity < 2020.1.1 (CVE-2020-15828)

The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.1. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions. CVE-2020-15828 Note that Nessus has not...

JetBrains TeamCity < 2020.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2020.2. It is, therefore, affected by multiple vulnerabilities: - JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. CVE-2021-25773 - In JetBrains TeamCity before 2020.2, an ECR token could ...

CVE-2026-56705: External Control of File Name or Path

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

JetBrains TeamCity < 2019.2.2 (CVE-2020-11687)

The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages. CVE-2020-11687 Note that Nessus has not tested for this...

CVE-2026-71510

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

EUVD-2026-65083

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

CVE-2026-71510

Dolibarr versions prior to 24.0.0 are affected by a SQL injection in the users REST API. The root cause is that unsanitized filter parameters are spliced directly into SQL WHERE clauses without column restrictions, enabling authenticated users with user-read rights to extract sensitive data not e...

CVE-2026-78376 Webkitgtk: use-after-free of jscvalue function parameters

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption...

CVE-2026-78376 Webkitgtk: use-after-free of jscvalue function parameters

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl: added a bounds check in dfhgetparamsize The dfhgetparamsize function can return a parameter size that is larger than the feature region, because the loop’s bounds check is evaluated before increasing the size. If the E...