EUVD-2026-60249

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

PYSEC-2026-3765

opensslencrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

CVE-2026-74880

The openssl_encrypt package (before 1.4.0) accepts refresh tokens as URL query parameters in its keyserver and telemetry server routes. Because URLs are logged in server logs, proxy logs, browser history, and HTTP Referer headers, attackers can extract these tokens to gain unauthorized access. Th...

CVE-2026-74880 openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

JNDI Injection

Apache CXF is vulnerable to JNDI Injection. The vulnerability is due to insufficient validation of JCA deployment descriptor ra.xml or runtime activation parameters, which allows an attacker who can manipulate these inputs to inject malicious JNDI references and potentially execute arbitrary code...

CVE-2026-75050: Allocation of Resources Without Limits or Throttling

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

PT-2026-76699

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-74251

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

PT-2026-73150

Name of the Vulnerable Software and Affected Versions Phoca Cart versions 5.0.0 through 6.1.16 Description An unauthenticated attacker can perform a SQL injection on the public shop items page. The issue occurs because the GET array parameters a attribute and s specification are concatenated...

CVE-2026-72347

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtconnmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmarktgshift. A shiftbits value of 32 or more triggers...

CVE-2026-72347 netfilter: xt_connmark: reject invalid shift parameters

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtconnmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmarktgshift. A shiftbits value of 32 or more triggers...

EUVD-2026-59246

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtconnmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmarktgshift. A shiftbits value of 32 or more triggers...

Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

...

CVE-2026-73054: Improper Authentication

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated...

PT-2026-72535

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Revision 2 of the CONNMARK target in netfilter accepts user-controlled shift parameters applied to 32-bit mark values within the connmark tg shift function. A shift bits value of 32 or...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 is affected by an authenticated reflected XSS in the HTML editor popup endpoint. The vulnerability arises because the text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding, enabling ...