CVE-2026-23732

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, FastGlyph parsing trusts cbData/remaining length and never validates against the minimum size implied by cx/cy. A malicious server can trigger a client‑side global buffer overflow, causing a crash DoS. Versi...

CVE-2026-1150

A security flaw has been discovered in Totolink LR350 9.3.5u.6369B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack can be launched remotely...

PT-2026-3504

A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to...

CVE-2025-15535 nicbarker clay clay.h Clay__MeasureTextCached null pointer dereference

A security flaw has been discovered in nicbarker clay up to 0.14. This affects the function ClayMeasureTextCached in the library clay.h. The manipulation results in null pointer dereference. The attack is only possible with local access. The exploit has been released to the public and may be used...

PT-2026-3376

A security vulnerability has been detected in cijliu librtsp up to 2ec1a81ad65280568a0c7c16420d7c10fde13b04. The affected element is the function rtsp rely dumps. The manipulation leads to buffer overflow. An attack has to be approached locally. This product is using a rolling release to provide...

n8n security vulnerabilities

n8n is an open-source, scalable workflow automation tool developed by n8n. n8n has a security vulnerability that allows attackers to bypass the Python-task-executor sandbox restrictions through string formatting and exception handling. This vulnerability could enable the execution of arbitrary...

CVE-2025-15532

Open5GS up to 2.7.5 is affected by a Timer Handler processing issue that leads to resource consumption. The vulnerability can be exploited remotely, and there are public exploits and a patch identified as c7c131f8d2cb1195ada5e0e691b6868ebcd8a845. Remediation guidance present in sources calls for ...

SUSE CVE-2025-69413

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists...

CVE-2021-47779

Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the...

CVE-2025-62582

Delta Electronics DIAView has multiple vulnerabilities...

CVE-2025-62581

Delta Electronics DIAView has multiple vulnerabilities...

CVE-2025-62581

Delta Electronics DIAView has multiple vulnerabilities...

MiracleLinux 4 : pam-1.1.1-20.AXS4.1 (AXSA:2015-439:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-439:01 advisory. PAM Pluggable Authentication Modules is a system security tool that allows system administrators to set authentication policy without having to recompile...

Moeditor security vulnerabilities

Moeditor is an open-source Markdown file editor developed by Moeditor. Version 0.2.0 of Moeditor contains a security vulnerability; this vulnerability stems from allowing the storage of malicious payloads in markdown files, which could lead to remote code execution...

Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

Summary The API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions e.g., name, key, type, default value used across documents, assets, and objects to standardize custom...

CVE-2026-0989

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may...

kernel: i40e: add validation for ring_len param

A flaw was identified in the Intel “i40e” Ethernet driver in the Linux Kernel where the ringlen parameter supplied by a VF virtual function is passed unchecked to the hardware memory context. If a malicious Virtual function provides a too-large or misaligned ringlen, it may allow the device to...

vert.x security vulnerability

Vert.x is an open-source toolkit developed by Eclipse Vert.x. There is a security vulnerability in Vert.x, which stems from improper implementation of the static program cache. This vulnerability could be exploited by specially crafted request URIs, leading to denial-of-service attacks against...

PHPGurukul Cyber Cafe Management System 安全漏洞

Cyber Cafe Management System is an internet cafe management system. Cyber Cafe Management System suffers from a SQL injection vulnerability that stems from the adminprofile.php endpoint's adminname parameter not being sufficiently cleaned of user input, no details of the vulnerability are availab...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002300)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002300 advisory. The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended...