CVE-2026-5543

A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown function of the file /admin/yesterday-reg-users.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible...

GHSA-XPG8-3HHP-P7W8 vulnerabilities

Vulnerabilities for packages: temporal-fips, temporal...

GHSA-F2HX-5FX3-HMCV vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

[SECURITY] Fedora 42 Update: mapserver-8.4.1-3.fc42

MapServer is an Open Source platform for publishing spatial data and interactive mapping applications to the web...

Acrel Electrical Prepaid Cloud Platform 访问控制错误漏洞

Acrel Electrical Prepaid Cloud Platform is a platform developed by Acrel Electric of China. Version 1.0 of the Acrel Electrical Prepaid Cloud Platform contains an access control vulnerability, which stems from improper handling of the /bin.rar file. This vulnerability may lead to information...

Dromara Lamp-Cloud 授权问题漏洞

Dromara Lamp-Cloud is an open-source rapid development platform for microservices, built using Jdk11, SpringCloud, and SpringBoot. Versions of Dromara Lamp-Cloud 5.8.1 and earlier have a licensing issue vulnerability, which stems from improper authorization in the pageUser function...

venueless 安全漏洞

Venueless is an open-source online activity platform developed by Venueless. There are security vulnerabilities in Venueless, stemming from improper permission management. These vulnerabilities could allow users with API access and the “Manage Users” permission to delete user accounts from other...

Mono 代码注入漏洞

Mono is an open-source software platform used for creating .NET cross-platform applications. Version 0.58.4 of Mono contains a code injection vulnerability, which stems from the cross-site scripting found in the file packages/web-ui/src/tools/artifacts/SvgArtifact.ts...

CVE-2026-34947

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been...

CVE-2026-27481

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass vulnerability allows unauthenticated or unauthorized users to view hidden staff-only tags and its...

GHSA-P5RH-VMHP-GVCW vulnerabilities

Vulnerabilities for packages: dgraph...

RHSA-2026:2071 Red Hat Security Advisory: OpenShift Container Platform 4.18.33 packages and security update

Bulletin has no description...

RHSA-2024:3715 Red Hat Security Advisory: OpenShift Container Platform 4.12.59 packages and security update

Bulletin has no description...

RHSA-2023:5809 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2.2 Product Security and Bug Fix Update

Bulletin has no description...

Information Exposure

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Information Exposure via the client.log.php endpoint, which serves operational log files without enforcing authentication. An attacker can obtain sensitive interna...

Information Exposure

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Information Exposure via the install/test.php script when the command-line interface guard is disabled. An attacker can access sensitive information such as viewer...

CVE-2026-32211

Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network...

PT-2026-30325

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.17.0 Description Directus SSO login pages were missing the Cross-Origin-Opener-Policy COOP HTTP response header. This allowed a malicious cross-origin window to access and manipulate the window object of the...

CVE-2026-34768 Electron: Unquoted executable path in app.setLoginItemSettings on Windows

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettingsopenAtLogin: true wrote the executable path to the Run registry key without quoting. If the app ...

CVE-2026-34935

PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.openprocess with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command...