GHSA-6WCC-39RP-HH9P @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...

CVE-2026-14528

IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information...

EUVD-2026-50064

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

CVE-2026-14515 IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...

EUVD-2026-50063

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...

CVE-2026-14974

CVE-2026-14974 affects IBM WebSphere Application Server (traditional) 8.5 and 9.0. Root cause: unsafe deserialization of untrusted data, enabling remote code execution by a remote attacker. Affected versions include WebSphere Application Server 8.5.5.0–8.5.5.29 and 9.0.0.0–9.0.5.28 (as shipped in...

EUVD-2026-50022

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling due to improper handling of TRACE requests...

CVE-2026-16184 IBM WebSphere Application Server is affected by an authentication bypass

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

CVE-2026-16192 IBM WebSphere Application Server Liberty is affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled...

PT-2026-65588

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

PT-2026-65598

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

TencentOS Server 3: .NET 8.0 (TSSA-2026:0770)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0770 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-65447

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.6 versions...

EUVD-2026-49586

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslas...

CVE-2026-54540

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...

CVE-2026-66029 Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

CVE-2026-55578 Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...

CVE-2026-66433

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2026-17433 nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached...

[SECURITY] Fedora 44 Update: dotnet10.0-10.0.110-1.fc44

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...