HCL Aftermarket DPC Cross-Origin Resource Sharing Vulnerability

HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC suffers from a cross-origin resource sharing vulnerability that can be exploited by an attacker to steal sensitive data or perform actions as a legitimate user...

Unspecified Vulnerability in HCL Aftermarket DPC (CNVD-2026-15832)

HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC has a security vulnerability that can be exploited by attackers to hijack or impersonate administrator users...

Checkmk 安全漏洞

Checkmk is an IT monitoring platform developed by Checkmk Corporation. Versions of Checkmk prior to 2.5.0b2 contained security vulnerabilities. These vulnerabilities were due to a storage-side cross-site scripting issue, which could allow authenticated users to execute arbitrary JavaScript when...

PT-2026-29352

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description AVideo’s admin plugin configuration endpoint admin/save.json.php is susceptible to cross-site request forgery CSRF attacks due to the absence of CSRF token validation. The application's configuration...

Discourse 信息泄露漏洞

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from an information disclosure vulnerability that can be exploited by attackers to cause moderators to obtain informati...

PT-2026-29364

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description AVideo is an open source video platform. A debug endpoint, test.php, within the StripeYPT plugin is accessible to all logged-in users, not just administrators. This endpoint processes Stripe...

PT-2026-29333

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.30 Nautobot versions prior to 3.0.10 Description The application fails to enforce password validation rules defined by Django's AUTH PASSWORD VALIDATORS setting when creating or editing users via the REST API. Th...

Unspecified Vulnerability in HCL Aftermarket DPC (CNVD-2026-15834)

HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC suffers from a security vulnerability that can be exploited by attackers to cause a denial of service by consuming server bandwidth and processing resources through mass spamming...

IBM Concert Encryption Problem Vulnerability (CNVD-2026-16135)

IBM Concert is IBM's collaborative application lifecycle management platform. IBM Concert has a security vulnerability that stems from the use of a weaker-than-expected encryption algorithm. An attacker could exploit the vulnerability to decrypt highly sensitive information...

Unspecified Vulnerability in HCL Aftermarket DPC (CNVD-2026-15835)

HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC suffers from a security vulnerability that can be exploited by an attacker to maintain control of an account after accessing a session, despite a password change, leading to an...

HCL Aftermarket DPC Access Control Error Vulnerability

HCL Aftermarket DPC is a digital spare parts and aftermarket management platform for HCL India. HCL Aftermarket DPC suffers from an Access Control Error vulnerability that can be exploited by an attacker to elevate their privileges and compromise the application...

WWBN AVideo 授权问题漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained an authorization vulnerability. This vulnerability stemmed from the lack of permission verification for the overrideStatus parameter in the video processing...

PT-2026-29361

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The AVideo platform, specifically the Live plugin, has an issue where the on publish done.php endpoint does not perform authentication or authorization checks. Unauthenticated users can terminate acti...

PT-2026-29358

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description The AVideo platform, in versions 26.0 and prior, has an issue in the objects/emailAllUsers.json.php endpoint. This endpoint allows administrators to send HTML emails to all registered users. The...

Security Bulletin: NVIDIA BioNeMo Framework - March 2026

NVIDIA has released a software update for NVIDIA® BioNeMo Framework. To protect your system, clone or update this software to include commit e5e58c8 or later from the NVIDIA/BioNeMo Framework GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential...

NVIDIA Jetson Linux 安全漏洞

NVIDIA Jetson Linux is an edge AI and robotics development platform provided by NVIDIA Corporation. There is a security vulnerability in NVIDIA Jetson Linux, which stems from the undisabled trusted application nvluks in initrd, potentially leading to information leakage...

PT-2026-29363

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior Description AVideo is an open source video platform. The installation script, install/deleteSystemdPrivate.php, contains a PHP operator precedence bug in its command-line interface CLI-only access guard. The guar...

Umami SQL注入漏洞

Umami is a lightweight analysis platform provided by Umami Inc., which offers features for website access statistics and user behavior analysis. Umami has a SQL injection vulnerability, which stems from improper cleaning of the timezone request parameters. This vulnerability may lead to SQL...

Parse Server 安全漏洞

Parse Server is an open-source backend developed by the Parse Platform. It can be deployed on any infrastructure that supports Node.js. There were security vulnerabilities in versions of Parse Server prior to 8.6.69 and 9.7.0-alpha.14. These vulnerabilities stemmed from the possibility for...

WWBN AVideo 跨站请求伪造漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 26.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF token validation for the objects/pluginSwitch.json.php endpoint, whic...