319652 matches found
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos identified UAT-10147 targeting Windows and Linux web servers globally, impacting organizations in government, education, media, technology, and gaming sectors. The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale. UAT-10147 integrated AI-driven toolin...
OESA-2026-3462 udisks2 security update
The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies. Security Fixes: A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the...
OESA-2026-3461 udisks2 security update
The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies. Security Fixes: A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the...
OESA-2026-3460 udisks2 security update
The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies. Security Fixes: A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the...
OESA-2026-3453 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkillblock work in wiphyunregister There is a use-after-free error in cfg80211shutdownallinterfaces found by syzkaller: BUG: KASAN:...
OESA-2026-3424 postgresql-17 security update
PostgreSQL client programs Security Fixes: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the...
OESA-2026-3423 postgresql-17 security update
PostgreSQL client programs Security Fixes: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the...
OESA-2026-3422 postgresql security update
PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...
OESA-2026-3421 postgresql security update
PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...
OESA-2026-3420 postgresql security update
PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...
SecureAI-Scan v0.10.0
SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...
WordPress WP Directory Kit plugin < 1.5.7 - Admin+ SQL Injection via section Parameter vulnerability
Admin+ SQL Injection via section Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.7...
WordPress ProSolution WP Client plugin < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter vulnerability
Unauthenticated Blind SQLi via 'jobID' Parameter vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin ProSolution WP Client versions 2.0.6...
Vulnerabilities are hidden in Zabbix
Zabbix SIA has identified several vulnerabilities in Zabbix, including the API, frontend, script items, preprocessing components, and the Windows Agent installer. These vulnerabilities affect various aspects of Zabbix. - A problem with the login lockout mechanism causes multiple simultaneous fail...
DOMPurify v3.4.14
DOMPurify DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's also very simple to use and get started with. DOMPurify was started in February 2014 and, meanwhile, has reached version v3.4.14. DOMPurify runs as JavaScript and works in all modern browsers...
CVE-2026-76569
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
CVE-2026-76569
Phoca Download extension versions 5.0.0 through 6.1.4 for Joomla contains a reflected XSS flaw in the search GET parameter; attacker-supplied input is reflected unescaped, enabling script execution in a victim's browser. CVSS 4.0 scores it Medium (5.3). No exploitation or patch version is documen...
EUVD-2026-63211
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...
CVE-2026-76569 Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4...