CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720

CVE-2026-56720 — CamaleonCMS

EUVD-2026-56232

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-56720 CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint...

CVE-2026-19546

CVE-2026-19546 : In DBI, this entry describes a flaw that is a partial fix for CVE-2026-14380, affecting Red Hat Enterprise Linux releases 9.8.z and 10.2.z. The vulnerability enables arbitrary code execution via a caller-influenced profile attribute. The connected documents provide the same descr...

CVE-2026-19546 Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546...

CVE-2026-19546 Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546...

Windows User Profile Service Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows User Profile Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72553

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72553

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

EUVD-2026-56023

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72553 ElkArte Forum ElkArte - Cross-Site Scripting

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72553 ElkArte Forum ElkArte - Cross-Site Scripting

A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields custblurb and custlocate. The fields are saved without HTML encoding and rendered unescaped in profile views visible to administrators. An...

CVE-2026-72553

CVE-2026-72553 describes a stored cross-site scripting flaw in ElkArte Forum 2.0 Beta 1. The issue allows any registered member to inject persistent JavaScript into profile fields cust_blurb and cust_locate, which are saved without HTML encoding and rendered unescaped in admin-visible profile vie...

perl-DBI:1.641 security update

An update is available for perl-DBI, module.perl-DBI. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The perl-DBI package provides the standard database interfa...

RLSA-2026:52772 Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: DBI: Heap overflow when...

RockyLinux 8 : perl-DBI:1.641 (RLSA-2026:52772)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:52772 advisory. DBI: Heap overflow when preparsing SQL statements with excessive placeholders CVE-2026-14739 DBI: Arbitrary code execution via caller-influenced Profile...

CVE-2026-62832: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows User Profile Service allows an authorized attacker to elevate privileges locally...

CVE-2026-72605: Missing Authentication for Critical Function

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...