CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

PT-2026-111087

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.98.0 Frappe ERPNext versions 16.x prior to 16.6.0 Description Missing input validation in certain endpoints allows remote authenticated attackers to perform SQL injection. By sending specially crafted...

CVE-2026-85968: Out-of-bounds Read

Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory...

PT-2026-110792

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description The Query Console uses predictable Cross-Site Request Forgery CSRF tokens. CSRF is a technique where an attacker tricks...

PT-2026-110801

🚨 CVE-2026-85964 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files. 🎖@cveNotify...

CVE-2026-85964: Improper Limitation of a Pathname to a Restricted Directory

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files...

PT-2026-110813

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions 12.x prior to 12.1.0 Progress MarkLogic Server versions 11.x prior to 11.3.7 Description Insufficient sanitization of input used by the Query Console file-exploration endpoint allows for HTTP response...

CVE-2026-109638: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

CVE-2026-108168: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...

CVE-2026-108923: Improper Access Control

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...

CVE-2026-108834: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file wwpage.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out...

PT-2026-110896

Name of the Vulnerable Software and Affected Versions 1024-lab smart-admin versions prior to 3.30.0 Description An issue exists in the Support Config Query component within the '/support/config/queryByKey' endpoint. Remote manipulation of the configKey argument can lead to improper access control...

PT-2026-110545

Name of the Vulnerable Software and Affected Versions Cairo-dock Glx-Dock versions prior to 3.4.1 Description Remote cross site scripting is possible due to improper processing of the p argument within the Query Parameter Handler component in the ww page.php file. Cross site scripting is a...

CVE-2026-85960: Cross-Site Request Forgery (CSRF)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures an authenticated Query Console user to a malicious page could submit unauthorized requests and execute server-side code with the victim's...

CVE-2026-104332: Stack-based Buffer Overflow

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table...

PT-2026-110719

Name of the Vulnerable Software and Affected Versions Parse Server versions 8.2.2 through 8.6.93 Parse Server versions 9.0.0 through 9.10.1-alpha.13 Description GraphQL introspection control is only applied to operation text sent directly with a request and does not extend to operations resolved...

mihari

mihari Un agregador de consultas para la caza de amenazas basada en OSINT. Mihari puede agregar múltiples búsquedas a través de múltiples servicios en una sola regla y persistir los hallazgos en una base de datos. Mihari es compatible con los siguientes servicios por defecto. Censys CIRCL passive...

Malicious code in react-paginate-v5 (npm)

Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an implausibly high version 99.0.0 to win resolution against an...

netlas-cookbook

Netlas CookBook El objetivo de esta guía es enseñar a cualquier persona interesada en ciberseguridad, independientemente de su nivel de conocimiento, cómo aprovechar al máximo las herramientas de búsqueda de Netlas. Es una lectura extensa. Hemos recopilado la mayor cantidad posible de casos de us...

yeti

Plataforma Yeti Yeti tiene como objetivo cerrar la brecha entre los profesionales de CTI y DFIR al proporcionar una plataforma de inteligencia forense y un pipeline para equipos de DFIR. Nació de la frustración de tener que responder a la pregunta "¿dónde he visto este artefacto antes?" o "¿cómo...