37096 matches found
EUVD-2026-22752
Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting XSS attack due to improper handling of MIME type spoofing GHSL-2026-052. An attacker could exploit this flaw to inject malicious scripts, potentially...
EUVD-2026-22718
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/courserelusers endpoint is vulnerable to Insecure Direct Object Reference IDOR, allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into...
CVE-2026-34602 Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/courserelusers endpoint is vulnerable to Insecure Direct Object Reference IDOR, allowing an authenticated attacker to modify the user parameter in the request body to enroll any arbitrary user into...
EUVD-2026-22716
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference IDOR vulnerability that allows any authenticated student to read the private course notes of any other user on the platform by manipulating t...
CVE-2026-33416 affecting package libpng for versions less than 1.6.56-1
CVE-2026-33416 affecting package libpng for versions less than 1.6.56-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-25727 affecting package rust for versions less than 1.72.0-15
CVE-2026-25727 affecting package rust for versions less than 1.72.0-15. A patched version of the package is available...
CVE-2026-32775 affecting package libexif for versions less than 0.6.24-2
CVE-2026-32775 affecting package libexif for versions less than 0.6.24-2. A patched version of the package is available...
CVE-2026-1703 affecting package python-virtualenv for versions less than 20.26.6-3
CVE-2026-1703 affecting package python-virtualenv for versions less than 20.26.6-3. A patched version of the package is available...
CVE-2026-1489 affecting package glib for versions less than 2.71.0-10
CVE-2026-1489 affecting package glib for versions less than 2.71.0-10. A patched version of the package is available...
New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released
Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution. The vulnerabilities have been described as command injection flaws affecting the Perforce VCS version control softwa...
Squid: Squid: Denial of Service via crafted ICP traffic
A flaw was found in Squid. A remote attacker can exploit this vulnerability by sending specially crafted ICP Internet Cache Protocol traffic. This can lead to a Denial of Service DoS due to premature resource release and use-after-free vulnerabilities. This attack is possible in Squid deployments...
April 14, 2026-KB5082421 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1
None None...
JLSEC-2026-98 Deno's static imports inside dynamically imported modules do not adhere to permission checks
Impact Modules that are dynamically imported through import or new Worker might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing especially transitively untrusted code are...
SUSE-SU-2026:1322-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: - Update to 149.0.2 and 140.9.1esr bsc1261663. - CVE-2026-5731: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2. - CVE-2026-5732: Incorrect boundary...
CVE-2026-40077
Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they kno...
GHSA-527G-3W9M-29HV mitmproxy has an LDAP Injection
Impact In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is n...
[SECURITY] Fedora 43 Update: python-cryptography-46.0.7-1.fc43
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...
[SECURITY] Fedora 43 Update: webkitgtk-2.52.1-1.fc43
WebKitGTK is the port of the WebKit web rendering engine to the GTK platform...