Important: postgresql

Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...

PT-2026-83775

Name of the Vulnerable Software and Affected Versions HTML::FormFu versions prior to 2.09 Description Repeatable elements allow resource exhaustion through an unbounded repeat count provided via the query string. When a Repeatable element has counter name set, the process function reads the repea...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2026-2077)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2077 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2026-2078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2078 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Linux Distros Unpatched Vulnerability : CVE-2026-82854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2071 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Drop all SCM attributes for SOCKMAP. CVE-2026-53005 In the Linux kernel, the following vulnerability has been...

Important: freerdp

Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...

Important: freerdp

Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...

SUSE SLES11: kernel-default / kernel-default-base / kernel-ec2 / kernel-ec2-base / etc (SUSE-SU-2026:3809-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3809-1 advisory. The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-53995:...

C-MOR 6.0104 - Directory Traversal

Exploit Title: C-MOR 6.0104 - Directory Traversal Google Dork: N/A Date: 2026-07-23 Exploit Author: Fadi Kaakahji Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link: https://www.c-mor.com/ Version: Aufnahmen Kamera 5../../../../../../../../../../../../../../../../etc/passwd,...

CubeCart 6.7.4 - SQL

Exploit Title: CubeCart 6.7.4 - SQL Bypass in maintenance.index.inc.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54646 Advisory / References...

CVE-2025-63607

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

Amazon Linux 2 : postgresql, --advisory ALAS2POSTGRESQL14-2026-025 (ALASPOSTGRESQL14-2026-025)

The version of postgresql installed on the remote host is prior to 14.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2026-025 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database us...

CubeCart 6.7.4 Cross Site Scripting

CubeCart version 6.7.4 suffers from multiple cross site scripting vulnerabilities. Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link:...

PT-2026-83985

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contact display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

PT-2026-83878

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbd cron process parameter without authentication. Attackers can predict the...

PT-2026-83751

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An issue exists where the software fails to validate if authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints. This allows any user...

CVE-2025-63607

TechStore 1.0 contains a Cross-Site Scripting (XSS) vulnerability in the contact_display function, where the id parameter is echoed verbatim into the rendered page, allowing execution of attacker-supplied JavaScript in a victim's browser. The CVSS 3.1 score is 6.1 (Medium) , with a changed scope ...

The vulnerability of the setMacFilterRules() function in the MAC Filtering component of TOTOLINK A720R microprogrammed router software allows a intruder to trigger a service failure.

The vulnerability of the setMacFilterRules function in the MAC Filtering component of TOTOLINK A720R microprogrammed router software is related to the output of the operation being written outside of the buffer in memory when processing the desc parameter. Exploiting this vulnerability could allo...

Amazon Linux 2 : freerdp, --advisory ALAS2-2026-3887 (ALAS-2026-3887)

The version of freerdp installed on the remote host is prior to 2.11.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3887 advisory. FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the...