CVE-2026-29172

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part column name is passed directly as an array key to orderBy without whitelist...

GO-2026-4617 Gogs: Release tag option injection in release deletion in gogs.io/gogs

Gogs: Release tag option injection in release deletion in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please sugge...

DHS Ousts CBP Privacy Officers Who Questioned ‘Illegal’ Orders

Department of Homeland Security leaders removed top privacy officers who objected to mislabeling government records to block their public release, WIRED has learned...

CVE-2026-22614

The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper with the project file. This security issue has bee...

CVE-2026-31793 iccDEV has a SEGV in CIccCalculatorFunc::ApplySequence()

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a segmentation fault due to invalid/wild pointer read in CIccCalculatorFunc::ApplySequence causing denial of service. This vulnerability is fixed in 2.3.1.5...

CVE-2026-24283

creationtimestamp| type| source ---|---|--- 2026-03-10 16:57:37+00:00| seen| https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review 2026-03-10 19:07:55+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0080 2026-03-11 03:00:16+00:00| seen|...

400,000 WordPress Sites Affected by Unauthenticated SQL Injection Vulnerability in Ally WordPress Plugin

On February 4th, 2026, we received a submission for an SQL Injection vulnerability in Ally, a WordPress plugin estimated to have more than 400,000 active installations. This vulnerability can be leveraged to extract sensitive data from the database, such as password hashes. Props to Drew Webber...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corrupti...

[SECURITY] Fedora 42 Update: perl-Net-CIDR-0.27-1.fc42

The Net::CIDR package contains functions that manipulate lists of IP netblocks expressed in CIDR notation. The Net::CIDR functions handle both IPv4 and IPv6 addresses...

[SECURITY] Fedora 43 Update: chromium-145.0.7632.159-1.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 43 Update: mingw-zlib-1.3.2-1.fc43

MinGW Windows zlib compression library...

The vulnerability of the afu_allocate_irqs() function in the drivers/misc/cxl/irq.c module of the Linux kernel allows a attacker to cause a service failure.

The vulnerability of the afuallocateirqs function in the drivers/misc/cxl/irq.c file of the Linux kernel is related to improper memory release memory leak. Exploiting this vulnerability may allow a remote attacker to cause a service failure...

The vulnerability of the xc5000_release() function in the drivers/media/tuners/xc5000.c module of the Linux operating system’s multimedia device driver, which allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the xc5000release function in the drivers/media/tuners/xc5000.c module of the Linux kernel’s multimedia device driver relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

Build Numbers and Versions of Veeam Plug-In for HPE Morpheus VM Essentials

This KB article lists all versions of the Veeam Plug-in for HPE Morpheus VM Essentials and their respective worker build numbers. Version | Plug-In / Worker Build | Release Date ---|---|--- Veeam Plug-in for HPE Morpheus VM Essentials 2 Releases Veeam Plug-in for HPE Morpheus VM Essentials 2.0...

The vulnerability of the af_alg_sendmsg() function in the crypto/af_alg.c module of the Linux kernel’s cryptographic subsystem allows a hacker to induce a service failure.

The vulnerability of the afalgsendmsg function in the crypto/afalg.c module of the Linux kernel’s cryptographic subsystem is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2026-24219

A vulnerability has been identified in SICAM SIAPP SDK All versions V2.1.7. An out-of-bounds write vulnerability exists in SICAM SIAPP SDK. This could allow an attacker to write data beyond the intended buffer, potentially leading to denial of service, or arbitrary code execution...

Giflib 安全漏洞

Giflib is an open-source library and utility for processing GIFs in OpenEuler. Giflib has a security vulnerability, which stems from improper error handling and shallow copying in GifMakeSavedImage, potentially leading to double release of resources...

The vulnerability of the d_alloc_parallel() function in the fs/dcache.c module of the Linux kernel file system allows a attacker to cause a service failure.

The vulnerability of the dallocparallel function in the fs/dcache.c module of the Linux kernel’s file system is related to improper memory release. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of Linux operating system’s Ice kernel components, which allows a hacker to cause a service failure

The vulnerability of Ice components in the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the set_current_kprobe() function in the arch/x86/kernel/kprobes/core.c module, which is part of the Linux operating system’s x86 kernel support, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setcurrentkprobe function in the arch/x86/kernel/kprobes/core.c module, which is part of the Linux operating system’s x86 kernel support, relates to the improper disabling or release of resources. Exploiting this vulnerability can allow an attacker to compromise the...