249070 matches found
PT-2026-65702
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover...
PT-2026-65748
Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...
PT-2026-65704
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...
CVE-2025-67407
CVE-2025-67407 affects Sourcecodester CASAP Automated Enrollment System 1.0. The connected documents confirm a SQL Injection vulnerability in update_student.php triggered via the parameters fname and student_class . The CVSS 3.1 base metrics indicate a HIGH severity (7.3) with network attack vect...
SUSE SLES12: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3367-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3367-1 advisory. This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server...
EUVD-2025-210530
kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php...
CVE-2025-69942
CVE-2025-69942 affects kishan0725 Hospital Management System 4.0 and is described as a SQL Injection vulnerability in the endpoint /hms/doctor/view-patient.php?viewid=1. The connected sources provide explicit vulnerability details (SQLi in the listed path) and a CVSS 3.1 vector with base score 9....
The vulnerability of the grab_requested_mnt_ns() function in the fs/namespace.c module of the Linux kernel file system allows a attacker to trigger a service failure.
The vulnerability of the grabrequestedmntns function in the fs/namespace.c module of the Linux kernel file system is related to the failure to release resources after their useful life has expired. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2025-67404
Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...
CVE-2025-69949
CVE-2025-69949 affects Kishan0725 Hospital Management System 4.0. The vulnerability is a SQL Injection in check_availability.php exploitable via the parameters emailid and email. The CVSS 3.1 base score is 7.3 (High) with network attack vector, low attack complexity, no privileges required, and n...
Critical Photon OS Security Update - PHSA-2026-5.0-0933
Updates of 'gawk' packages of Photon OS have been released...
CVE-2025-67405
CVE-2025-67405 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is a SQL Injection in update_password.php via the parameter new_password . This is the root cause, allowing unintended database queries. Documented impact shows low confidentiality, integrity, and avail...
Check Point Gaia Operating System (sk185153)
The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185153 advisory. - A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with roo...
CVE-2025-67408
CVE-2025-67408 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is an SQL Injection in /save_user.php via the parameter status. Documented impact is partial confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 7.3 (HIGH), attack vector N...
CVE-2026-55391
CVE-2026-55391 affects the datamodel-code-generator project. Prior to version 0.63.0, the tool validates a URL host in http.py via get_body, _validate_url_for_fetch, and _get_ips_from_host, but then allows httpx to resolve the host again for the connection, enabling DNS rebinding to bypass allow_...
CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...
firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: DNS component...
CVE-2026-13463
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...
MAL-2026-11161 Malicious code in @joyfill/layouts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2f0675d4a2717361ec79b2c5a5cbf0ff0367e8d9cbf991f2f300df6c6b819ec Analysis of @joyfill/[email protected] surfaced no a static rule matches and no traced code paths indicating exfiltration, install-time remot...