22008 matches found
PT-2026-30884
FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution RCE vulnerability in the DNS host record configuration parameter dns.hostRecord. This vulnerability allows an...
RockyLinux 9 : grafana (RLSA-2026:6382)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:6382 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Tenable has extracted the preceding description block directly from the RockyLinux...
WWBN AVideo 路径遍历漏洞
WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 26.0 contained a path traversal vulnerability. This vulnerability allowed attackers to bypass the allowed access control by using the same domain URL, potentially leading t...
PT-2026-30886
FTLDNS pihole-FTL provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution RCE vulnerability in the DHCP hosts configuration parameter dhcp.hosts. This vulnerability allows an authenticat...
PT-2026-30861
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.has object permission returns True for all HTTP methods —...
PT-2026-30939
ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS requests to arbitrary hosts SSRF by supplying a crafted URL in the Referer request header. The server subsequently makes an outbound request to the attacker-controlled domain,...
CVE-2025-39748 affecting package kernel for versions less than 6.6.130.1-3
CVE-2025-39748 affecting package kernel for versions less than 6.6.130.1-3. A patched version of the package is available...
CVE-2026-23066 affecting package kernel for versions less than 6.6.130.1-3
CVE-2026-23066 affecting package kernel for versions less than 6.6.130.1-3. A patched version of the package is available...
CVE-2025-71203 affecting package kernel for versions less than 6.6.130.1-3
CVE-2025-71203 affecting package kernel for versions less than 6.6.130.1-3. A patched version of the package is available...
CVE-2025-69720 affecting package ncurses for versions less than 6.4-3
CVE-2025-69720 affecting package ncurses for versions less than 6.4-3. A patched version of the package is available...
CVE-2026-35452 WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin. The log contains internal filesyste...
CVE-2026-35448
CVE-2026-35448 affects WWBN AVideo prior to version 27.x (plugin: BlockonomicsYPT/check.php). The endpoint accepts a Bitcoin address via GET and returns the corresponding payment order data without any authentication or access control. This enables unauthenticated disclosure of sensitive fields s...
CVE-2026-35475 WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect']
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $GET with no URL validation or whitelist check, then used verbatim in a header"Location: ..." call. This vulnerability is fixed in 3.6.9...
CVE-2026-35475
WeGIA (Web manager for charitable institutions) suffers an open redirect vulnerability prior to version 3.6.9. The redirect parameter is read directly from $_GET with no URL validation or whitelist, and is then used verbatim in a Location header, enabling potential redirection abuse. This is miti...
CVE-2026-35474
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $GET with no URL validation or whitelist check, then used verbatim in a header"Location: ..." call. This vulnerability is fixed in 3.6.9...
CVE-2026-35472
WeGIA (Web manager for charitable institutions) has an Open Redirect in the /WeGIA/controle/control.php endpoint, exploitable via the nextPage parameter when used with metodo=listarTodos and nomeClasse=EstoqueControle. The application does not validate/restrict nextPage, enabling redirects to arb...
CVE-2026-35472
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle...
CVE-2026-35213 Regular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing
@hapi/content provided HTTP Content- headers parsing. All versions of @hapi/content through 6.0.0 are vulnerable to Regular Expression Denial of Service ReDoS via crafted HTTP header values. Three regular expressions used to parse Content-Type and Content-Disposition headers contain patterns...
EUVD-2026-19458
Brave CMS is an open-source CMS. Prior to 2.0.6, this vulnerability is a missing authorization check found in the update role endpoint at routes/web.php. The POST route for /rights/update-role/id lacks the checkUserPermissions:assign-user-roles middleware. This allows any authenticated user to...