277432 matches found
CVE-2026-65579
Unauthenticated PHP Object Injection in Agricola = 1.21.0 versions...
EUVD-2026-53995
Unauthenticated PHP Object Injection in Advice = 1.18.0 versions...
CVE-2026-5134
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...
CVE-2026-5134 SQLi in Loca Software's CMS
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...
CVE-2026-5134
CVE-2026-5134 describes an SQL injection in Loca Software Informatics Technology Ltd. Co. CMS. Affected as of CMS version up to 06082026. The issue is due to improper neutralization of special elements used in SQL commands (SQLi) and is classified with CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:...
EUVD-2026-53928
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...
CVE-2026-5134 SQLi in Loca Software's CMS
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in a...
ROOT-APP-PYPI-GHSA-956X-8GVW-WG5V GHSA-956x-8gvw-wg5v in GitPython - Patched by Root
Root has patched GHSA-956x-8gvw-wg5v in the GitPython package for Root:PyPI. Multiple fixed versions available...
CVE-2026-68079
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...
CVE-2026-8166 Stored XSS in Logo Software's e-Logo Purchasing Portal
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...
EUVD-2026-53866
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...
EUVD-2026-53862
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issu...
EUVD-2026-53861
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...
EUVD-2026-53859
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks issuer/subject/audience/time and subjwk binding, enabling authentication bypass with crafted tokens. However, note that self-issued ID tokens are not accepted by default in...
CVE-2026-64958 Apache CXF: Denial of service via message header attachments
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue...
RHSA-2026:43716 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Bulletin has no description...
CVE-2026-54225 Apache CXF: Denial of Service attack via large attachments
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...
Critical: Red Hat Security Advisory: OpenShift Container Platform 4.17.56 bug fix and security update
Red Hat OpenShift Container Platform release 4.17.56 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...