8206 matches found
SUSE: Security Advisory (SUSE-SU-2026:20587-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Firefly III user API endpoints expose all users' information to any authenticated user (IDOR)
Summary The User management API endpoints GET /api/v1/users and GET /api/v1/users/id are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status. Affected Endpoints 1. GET /api/v1/users UserController::index, line ...
Flowise 安全漏洞
Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Versions of Flowise prior to 3.0.13 contained security vulnerabilities, which were caused by insecure direct object references. These vulnerabilities could lead to account takeover and bypassing...
OPENSUSE-SU-2026:20333-1 Security update for python-PyPDF2
This update for python-PyPDF2 fixes the following issues: Changes in python-PyPDF2: - CVE-2026-27628: Fixed infinite loop when loading circular /Prev entries in cross-reference streams bsc1258940 - CVE-2026-27888: Fixed issue where manipulated FlateDecode XFA streams can exhaust RAM bsc1258934 -...
CVE-2026-3653
REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2026-2752
Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and...
CVE-2026-1799
REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate has been determined not to be a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
WeKan 安全漏洞
WeKan is an open-source dashboard application developed by WeKan. Versions 8.32 and 8.33 of WeKan contain security vulnerabilities. These vulnerabilities stem from insecure direct object references, which could allow unauthorized users to modify custom fields across dashboards...
c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects
A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...
WordPress WPSubscription plugin <= 1.8.10 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Jitlada in WordPress Plugin WPSubscription versions = 1.8.10...
Linux Distros Unpatched Vulnerability : CVE-2025-10990
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; ...
The Iranian Cyber Capability 2026
The Iranian Cyber Capability 2026 By John Fokker and Ernesto Fernández Provecho · March 5, 2026 Introduction In 2024, we published an assessment of the Islamic Republic of Iran’s cyber capabilities, outlining the structure, tradecraft, and strategic intent of Iranian-aligned threat actors. The co...
CVE-2026-28696 Craft affected by IDOR via GraphQL @parseRefs
Craft is a content management system CMS. Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tags e.g., user:1:email, can be abused by both authenticated users and unauthenticated guests if a Public Schema is enabled to access sensitive...
CLEANSTART-2026-CQ83284 Redis is an open source, in-memory database that persists on disk
Multiple security vulnerabilities affect the valkey package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details...
SUSE: Security Advisory (SUSE-SU-2026:0703-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CLEANSTART-2026-MW73882 filippo
Multiple security vulnerabilities affect the argo-workflows package. filippo. See references for individual vulnerability details...
CVE-2025-63911
creationtimestamp| type| source ---|---|--- 2026-03-02 17:29:31+00:00| seen| https://gist.github.com/GregDurys/d402038147e36de5908159d9722072ef 2026-03-02 17:29:33+00:00| seen| https://gist.github.com/GregDurys/74c36c36bef81293a42022758f2736a9 2026-03-02 17:29:34+00:00| seen|...
CVE-2026-23600
creationtimestamp| type| source ---|---|--- 2026-03-02 16:17:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116160479516533305 2026-03-02 16:36:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg3osa4hm22o 2026-03-03 05:00:00+00:00| seen|...
Important: Red Hat Security Advisory: firefox security update
An update for firefox is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
