MINI-PP3M-M38G-C4GP

Bulletin has no description...

com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects

A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted javax.naming.Reference or serialized object to an application using the library. This can provoke the application to download and execute arbitrary...

c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...

c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects

A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...

SUSE-SU-2026:1970-1 Security update for php-composer2

This update for php-composer2 fixes the following issues - CVE-2026-40176: command injection via malicious Perforce repository definition bsc1262254. - CVE-2026-40261: command injection via malicious Perforce source reference/url bsc1262255. Changes for php-composer2: - version update to 2.2.27...

CVE-2026-6342

Mattermost plugins vulnerable to a namespace prefix-matching bypass. Affected: Mattermost Plugins versions

PT-2026-41688

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.9.0 Description Stored Cross-Site Scripting XSS exists due to a failure in the html purify validation rule used to sanitize blog post bodies. The rule relies on by-reference mutation ?string &$str, but the underlyi...

MINI-PRPH-2C56-3GWX

Bulletin has no description...

MINI-GMR9-9QJ8-Q7PG

Bulletin has no description...

MINI-XV97-6F42-M547

Bulletin has no description...

MINI-V646-454J-MFWC

Bulletin has no description...

MINI-JWF3-38WQ-VRJP

Bulletin has no description...

MINI-MGXJ-7546-CXHQ

Bulletin has no description...

MINI-5R3H-V7V6-V8FQ

Bulletin has no description...

MINI-4624-8HPG-RCJ5

Bulletin has no description...

MINI-767R-9MHJ-HRPP

Bulletin has no description...

MINI-M4RQ-GH8P-22G5

Bulletin has no description...

MINI-7H2P-GJ9F-4VP9

Bulletin has no description...

MINI-2QC4-M2QW-8HC6

Bulletin has no description...

Improper Access Control

getgrav/grav-plugin-api is vulnerable to Improper Access Control. The vulnerability is due to an insecure direct object reference and flawed permission update logic in UsersController::update, which allows an attacker to escalate privileges to Super Administrator and gain full system access...