CVE-2026-1267: Exposure of Sensitive Information to an Unauthorized Actor

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls...

CVE-2026-4358: Double Free

A specially crafted aggregation query with $lookup by an authenticated user with write privileges can cause a double-free or use-after-free memory issue in the slot-based execution SBE engine when an in-memory hash table is spilled to disk...

Exploit for Race Condition in Canonical Ubuntu_Linux

Dillu-Analyzer 🛡️ Dillu Analyzer — A web-based universal malwa...

CVE-2025-62319: Improper Neutralization of Special Elements used in an SQL Command

Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions TRUE or FALSE into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the...

CVE-2026-3020: Authorization Bypass Through User-Controlled Key

Identity based authorization bypass vulnerability IDOR that allows an attacker to modify the data of a legitimate user account, such as changing the victim's email address, validating the new email address, and requesting a new password. This could allow them to take complete control of other...

CVE-2025-52648: Improper Verification of Cryptographic Signature

HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the system...

CVE-2026-20989: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Font Settings prior to SMR Mar-2026 Release 1 allows physical attackers to use custom font...

CVE-2026-32630: Improper Handling of Highly Compressed Data (Data Amplification)

file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer, fileTypeFromBlob, or fileTypeFromFile. The ZIP inflate output limit is enforced for...

CVE-2026-30876: Observable Response Discrepancy

Chamilo LMS is a learning management system. Prior to version 1.11.36, Chamilo is vulnerable to user enumeration with valid/invalid username. This issue has been patched in version 1.11.36...

CVE-2026-20992: Incorrect Authorization

Improper authorization in Settings prior to SMR Mar-2026 Release 1 allows local attacker to disable configuring the background data usage of application...

CVE-2025-12736: Use of Uninitialized Resource

in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource...

CVE-2026-32777: Loop with Unreachable Exit Condition

libexpat before 2.7.5 allows an infinite loop while parsing DTD content...

CVE-2026-3644: Improper Input Validation

The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput lacked the output validation applie...

CVE-2026-4179: Loop with Unreachable Exit Condition

Issues in stm32 USB device driver drivers/usb/device/usbdcstm32.c can lead to an infinite while loop...

CVE-2025-6969: Improper Input Validation

in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input...

CVE-2026-30405: Uncontrolled Resource Consumption

An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXTHOP path attribute...

web_vuln_scanner

webvulnscanner A cybersecurity...

linux-security-tools

Linux Security Tools Linux security tools, scanners, crackers...

CVE-2026-31922: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through = 1.0.6.3...

CVE-2026-32357: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through = 2.37...