PT-2026-7465

Name of the Vulnerable Software and Affected Versions GE Vernova Enervista versions prior to 8.6 Description A flaw exists in GE Vernova Enervista UR Setup on Windows that permits file manipulation. Recommendations Update to a version later than 8.6...

Adobe Substance3D Stager 缓冲区错误漏洞

Substance 3D Stager is the United States of America Ordoby Adobe company launched a dedicated to the 3D scene set, lighting settings and high-quality rendering of professional software. An out-of-bounds write vulnerability exists in Adobe Substance 3D Stager 3.1.6 and earlier versions, which can ...

CVE-2025-13151 affecting package libtasn1 for versions less than 4.19.0-3

CVE-2025-13151 affecting package libtasn1 for versions less than 4.19.0-3. A patched version of the package is available...

CVE-2025-68724 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-68724 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2025-71089 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-71089 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2025-68264 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-68264 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

Improper Validation of Specified Type of Input

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the ?script=version endpoint, which does not properly validate the origin of incoming POST data. An attacker can cause a...

CVE-2026-25478

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.20.0, CORSConfig.allowedoriginsregex is constructed using a regex built from configured allowlist values and used with fullmatch for validation. Because metacharacters are not escaped, a malicious origin can match...

PYSEC-2026-2197

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to 2.20.0, FileStore maps cache keys to filenames using Unicode NFKD normalization and ord substitution without separators, creating key collisions. When FileStore is used as response-cache backend, an unauthenticated remo...

CVE-2026-25057

CVE-2026-25057 affects MarkUs prior to version 2.9.1. Instructors can upload a zip file to create an assignment from an exported configuration, and the zip entry names are used to construct paths for writing files to disk without validating those paths. This can allow arbitrary path usage during ...

CVE-2026-25479

Litestar is an ASGI framework. Prior to 2.20.0, litestar.middleware.allowed_hosts compiles allowlist entries into regex patterns in a way that lets regex metacharacters retain special meaning (e.g., . matches any character). This can enable a bypass where a host that matches the regex is not the ...

BIT-CHECKOV-2021-3040 Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution

An unsafe deserialization vulnerability in Bridgecrew Checkov by Prisma Cloud allows arbitrary code execution when processing a malicious terraform file. This issue impacts Checkov 2.0 versions earlier than Checkov 2.0.139. Checkov 1.0 versions are not impacted...

CVE-2026-22922

CVE-2026-22922 affects Apache Airflow versions 3.1.0–3.1.6, where an authorization flaw could allow an authenticated user with custom permissions limited to task access to view task logs without task-log access. The issue has been fixed in Airflow 3.1.7 and later. Practical impact is limited to l...

WordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WooCommerce Bulk Product Editor versions = 3.0...

WordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin User Extra Fields versions = 16.8...

CVE-2025-66595

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product is vulnerable to Cross-Site Request Forgery CSRF. When a user accesses a link crafted by an attacker, the user’s account could be compromised. The affected products and versions are as follows:...

CVE-2025-66602

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts access by IP address. When a worm that randomly searches for IP addresses intrudes into the network, it could potentially be attacked by the worm. The affected products and versions are ...

CVE-2025-66594

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed on the error page. This information could be exploited by an attacker for other attacks. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVRN, UNSVRN,...

CVE-2025-66606

CVE-2025-66606 affects Yokogawa FAST/TOOLS (R9.01–R10.04) with multiple packages listed (RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB). The vulnerability arises from improper URL encoding, enabling an attacker to tamper with web pages or execute malicious scripts. Connected sources confirm the affected ...

CVE-2026-25859

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations...