MAL-2026-1895 Malicious code in bigmathex (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1894 Malicious code in async-substrate-interface-sub (PyPI)

--- -= Per source details. Do not edit below this line.=-...

EUVD-2026-12706

A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /addresult.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used...

PT-2026-26156

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query...

Linux kernel 安全漏洞

The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from improper handling of the statistical report area when the number of queues changes. This could lead to...

CVE-2017-8806

creationtimestamp| type| source ---|---|--- 2026-03-18 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0315/...

CVE-2026-23262: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruption on queue count change The driver and the NIC share a region in memory for stats reporting. The NIC calculates its offset into this region based on the total size of the stats region and the size o...

CVE-2026-32698: Improper Neutralization of Special Elements used in an SQL Command

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection attack via a custom field's name. When that custom field was used in a Cost Report, the custom field's name was injected into the SQL query...

CVE-2025-58112

Microsoft Dynamics 365 Customer Engagement on-premises 1612 9.0.2.3034 allows the generation of customized reports via raw SQL queries in an upload of a .rdl Report Definition Language file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting...

Microsoft Dynamics 365 Customer Engagement 安全漏洞

Microsoft Dynamics 365 Customer Engagement is an enterprise-level application system developed by Microsoft for customer relationship management and business process automation. Version 1612.2.3034 of Microsoft Dynamics 365 Customer Engagement contains a security vulnerability. This vulnerability...

CVE-2025-58112

Microsoft Dynamics 365 Customer Engagement on-premises 1612 9.0.2.3034 allows the generation of customized reports via raw SQL queries in an upload of a .rdl Report Definition Language file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting...

CVE-2025-58112

Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) is vulnerable to the execution of arbitrary SQL commands due to improper handling of raw SQL queries during the upload of a .rdl (Report Definition Language) file. This file is subsequently processed by the SQL Server Repo...

Linux Distros Unpatched Vulnerability : CVE-2026-23262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gve: Fix stats report corruption on queue count change The driver and the NIC share a region in memory for stats reporting. The NIC calculates its offset into...

PT-2026-26197

Name of the Vulnerable Software and Affected Versions PySpector versions prior to 0.1.7 Description PySpector, a static analysis security testing SAST Framework, is affected by a stored Cross-Site Scripting XSS issue in its HTML report generator. When scanning a Python file containing JavaScript...

Hangzhou Hikvision Digital Technology Co., Ltd. Face Recognition Modules SADP XML parsing stack-based buffer overflow vulnerability

Talos Vulnerability Report TALOS-2025-2281 Hangzhou Hikvision Digital Technology Co., Ltd. Face Recognition Modules SADP XML parsing stack-based buffer overflow vulnerability March 18, 2026 CVE Number CVE-2025-66176 SUMMARY A stack-based buffer overflow vulnerability exists in the SADP XML parsin...

CVE-2026-26001 GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6...

CVE-2026-26001 GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6...

CVE-2026-26001 GLPI Inventory Plugin has SQL Injection on dropdown_calendar Report

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user input can lend to an SQL injection from reports, with adequate rights. This vulnerability is fixed in 1.6.6...

Assignment

Assignment Sql injection on a...

Canva Affinity EMF File EMR_CREATEDIBPATTERNBRUSHPT offBmi Out-Of-Bounds Read Vulnerability

Talos Vulnerability Report TALOS-2025-2300 Canva Affinity EMF File EMRCREATEDIBPATTERNBRUSHPT offBmi Out-Of-Bounds Read Vulnerability March 17, 2026 CVE Number CVE-2025-64733 SUMMARY An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafte...