AlmaLinux 9.2 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1773654558)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1773654558 advisory. - In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs ...

CVE-2026-102495

A flaw was found in Apache XMLSchema. The parser does not properly restrict how deeply schema imports and includes can be nested during processing. A remote attacker could provide a crafted schema with deeply nested references, triggering unbounded recursion that exhausts the call stack. This fla...

CVE-2026-93764

A flaw was found in Mongoid. When generating the client-side field-level encryption schema, Mongoid may fail to apply encryption rules to fields within embedded models. This oversight can lead to sensitive data, intended for encryption, being stored in plaintext without any indication or error...

CVE-2026-102495

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102496

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102497

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497

The Apache XmlSchema walker (xmlschema-walker) is vulnerable to a denial of service because it fails to detect cycles in type derivation, substitution groups, model groups, or attribute groups. A malicious schema containing such cycles can cause the walker to recurse indefinitely until a stack ov...

EUVD-2026-88739

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497 Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497 Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102496 Apache XMLSchema: Denial of service through deeply nested schema structures

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102496

Apache XmlSchema is vulnerable to a Denial of Service (DoS) due to a lack of depth limits when building its schema model. A remote attacker can provide a crafted XML schema with deeply nested elements, triggering uncontrolled recursion that leads to a stack overflow and crashes the application. T...

CVE-2026-102496 Apache XMLSchema: Denial of service through deeply nested schema structures

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102495

A flaw exists in Apache XmlSchema where the parser fails to restrict the nesting depth of schema imports and includes . A remote attacker can provide a crafted schema with deeply nested references to trigger unbounded recursion , causing a stack overflow. This results in an application crash and ...

CVE-2026-102495 Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-71203-PoC

CVE-2026-71203 — changedetection.io: /api/v1/full-spec における認証の欠如により完全な OpenAPI スキーマが開示される 製品: dgtlmoon/changedetection.io — v0.55.7 ファイル: changedetectionio/api/Spec.py CWE: CWE-306 — 重要な機能に対する認証の欠如 CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3 中 CNA: Turan Security · CVE レコード 説明...

CVE-2025-54554

CVE-2025-54554 CVE-2025-54554 – tiaudit REST API의 인증되지 않은 접근으로 인한 민감한 정보 노출 발견자: Amanpreet Parmar | 하버드 의과대학 수석 보안 엔지니어 요약: CVE-2025-54554는 Tera Insights가 개발한 ticrypt 플랫폼의 tiaudit 구성 요소에서 취약점을 식별합니다. 이 문제는 인증되지 않은 사용자가 REST API 엔드포인트에 접근하여 기본 SQL 쿼리 및 데이터베이스 구조에 대한 민감한 정보를 노출하도록 허용합니다. 설명 2025년 7...

CVE-2025-27407

CVE-2025-27407 GitLab Podman Lab GitLab Direct Transfer HTTP 경로가 취약한 graphql-ruby introspection 스키마 로더에 도달함을 증명하기 위한 최소 로컬 전용 랩입니다. 이 랩은 취약한 GitLab CE 컨테이너 하나를 실행하며, PoC 스크립트는 테스트 중에만 프로세스 내에서 가짜 GitLab 소스 서버를 시작합니다. 소유한 시스템이나 명시적으로 테스트 권한을 받은 시스템에서만 실행하세요. 파일 파일| 용도 ---|--- lab.sh| GitLab 랩을 시작,...

CVE-2026-33639

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...

EUVD-2026-87131

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator-controlled taxratedecimalplaces setting into an ALTER TABLE statement for iptaxrates in Settings::index without strict integer validation...