Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution

Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...

JoomSport <= 5.7.7 - SQL Injection

The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause. id: CVE-2026-42647 info: name: JoomSport =...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)

An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...

ROOT-OS-UBUNTU-2404-CVE-2025-71192 CVE-2025-71192 in linux - Patched by Root

Root has patched CVE-2025-71192 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

MAL-2026-17954 Malicious code in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff887d27322671592352c1e6755c4c39bc7be6f1bbb2148dc69ce2d3018a63e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff887d27322671592352c1e6755c4c39bc7be6f1bbb2148dc69ce2d3018a63e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is...

Astra Linux – vulnerability in ffmpeg

FFmpeg n7.0 is affected by a double free vulnerability in the rkmppretrieveframe function within libavcodec/rkmppdec.c...

Astra Linux – vulnerability in p7zip

The NtfsHandler.cpp NTFS handler in 7-Zip prior to version 24.01 for 7zz contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512i-2, where i=9, i=10, i=11, etc...

Astra Linux – vulnerability in libpgjava

pgjdbc is an open source PostgreSQL JDBC driver. In affected versions, a prepared statement utilizing either PreparedStatement.setTextint, InputStream or PreparedStatement.setByteaint, InputStream will create a temporary file if the InputStream exceeds 2 kilobytes in size. This creates a temporar...

Astra Linux – Vulnerability in Firefox

By using XSL Transforms, a malicious webserver could serve a user an XSL document that would continue to execute JavaScript within the bounds of the same-origin policy even after the tab was closed. This vulnerability affects Firefox versions earlier than 97...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux-6.1

In the Linux kernel up to 6.7.1, there is a use-after-free in cecqueuemsgfh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports digital signatures for ODF documents and macros within documents. It provides visual indicators that confirm that the document has not been altered since the last signature, and that the signature is valid. A vulnerability in certificate validation in LibreOffice allowed...

Astra Linux – vulnerability in mariadb-10.3

It has been discovered that MariaDB versions 10.2 through 10.7 contain a segmentation fault caused by the Itemfuncin::cleanup/Item::cleanupprocessor component...

Astra Linux – vulnerability in Imagemagick

A flaw was found in ImageMagick’s MagickCore/quantum.h. An attacker submitting a specially crafted file for processing by ImageMagick could trigger undefined behavior, resulting in values outside the permissible range for float and unsigned char. This would most likely compromise application...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. By exploiting vulnerabilities in the Lua script execution environment, an attacker with access to Redis prior to versions 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. T...

Astra Linux – vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns against supported commands such as KEYS, SCAN, PSUBSCRIBE, FUNCTION LIST, COMMAND LIST, and ACL definitions. Matching ...

Astra Linux – Vulnerability in Python 3.7, PHP 7.3

The Keccak XKCP SHA-3 reference implementation, prior to the update of fdc6fef, has an integer overflow and resulting buffer overflow issue. This vulnerability allows attackers to execute arbitrary code or compromise the expected cryptographic properties of the algorithm. This issue occurs within...

Astra Linux – vulnerability in jetty9

In Eclipse Jetty versions 7.x, 8.x, 9.2.27 and earlier, 9.3.26 and earlier, and 9.4.16 and earlier, the server running on any OS and any Jetty version combination will display the configured fully qualified directory base resource location in the output of a 404 error when no Context matching the...