33323 matches found
PT-2026-68214
Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description Improper privilege management in the SQL, SPARQL, and Optic REST query interfaces allows an authenticated user with a...
CVE-2026-7329: Improper Privilege Management
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged...
PT-2026-67967
Name of the Vulnerable Software and Affected Versions Kadence Memberships versions prior to 4.0.1 Description An issue exists where the legacy lost-password handler rc process lost password form consumes the attacker-controlled rc redirect POST parameter into two unvalidated sinks in...
CVE-2026-15452: Improper Neutralization of Input During Web Page Generation
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-71275: Improper Neutralization of Input During Web Page Generation
OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, " OTA requested for %s! ", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host= to execute JavaScript in an authenticated admin's brows...
CVE-2026-16071: Improper Neutralization of Special Elements used in an LDAP Query
A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...
PT-2026-68219
Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An authentication bypass exists in the ODBC App Server. This flaw allows an unauthenticated remote attacker to circumvent passwor...
PT-2026-68148
OpenBK7231T's http fn ota exec src/httpserver/http fns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /ota exec?host=alert1 to execute JavaScript in an authenticated...
kernel security, bug fix, and enhancement update
4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...
PT-2026-68221
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...
PT-2026-68026
Name of the Vulnerable Software and Affected Versions Askeet versions prior to 3.1 Description The Askeet plugin for WordPress contains a flaw allowing authenticated attackers with Administrator-level access and above to perform SQL Injection. The issue exists within the sql query parameter used ...
LiteLLM 1.83.6 Blind SQL Injection
A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...
CVE-2026-9195: Improper Neutralization of Input During Web Page Generation
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...
CVE-2026-18852 epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition
A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual condition...
CVE-2026-69704
Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...
CVE-2026-69704 Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()
Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...
django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-15307 via django (1.7.0)
django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-15830 via django (1.7.0)
django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
django-rulengine (0.0.1), drf-httpsig (1.2.0) +2 more potentially affected by CVE-2026-15830 via django (1.7.0)
django PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rulengine 0.0.1 - drf-httpsig 1.2.0 - tri-form 1.6.1 - tri-query 1.5.0 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...
