7595 matches found
Multiple vulnerabilities impacts AIX due to cURL libcurl
IBM SECURITY ADVISORY First Issued: Mon Sep 21 04:38:42 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/curladvisory12.asc Security Bulletin: Multiple vulnerabilities impacts AIX due to cURL libcurl...
Linux Distros Unpatched Vulnerability : CVE-2026-64847
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool...
CVE-2026-76899
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...
CVE-2026-52745
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...
CVE-2026-76899 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...
EUVD-2026-83373
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...
CVE-2026-76899 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...
CVE-2026-76901
CordysCRM , an open source AI-powered CRM supporting private deployment, contains a broken object-level authorization flaw prior to version 1.7.4 . The endpoints GET /pool/lead/get/{id} (in PoolClueController.get) and GET /pool/account/get/{id} (in PoolCustomerController.get) perform bare pool-re...
CVE-2026-52745 CordysCRM: Customer Public Pool Sorting Field SQL Injection
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...
EUVD-2026-83439
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...
CVE-2026-52745 CordysCRM: Customer Public Pool Sorting Field SQL Injection
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...
CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...
DEBIAN-CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...
UBUNTU-CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...
CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...
AnyIO process-pool workers can block indefinitely on undrained stderr
Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...
GHSA-5P39-CFHJ-2XMP AnyIO process-pool workers can block indefinitely on undrained stderr
Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redirected. Worker code...
CVE-2026-64847 AnyIO process-pool workers can block indefinitely on undrained stderr
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...
CVE-2026-64847
AnyIO is a high-level asynchronous concurrency framework. Prior to version 4.14.2 , process-pool workers are started with stderr connected to a pipe that the parent never drains , despite documentation stating all three standard streams are redirected. While stdin and stdout are redirected to /de...
CVE-2026-64847
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...