EUVD-2026-107662

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer REST API endpoint for lookup table...

CVE-2025-22964

CVE-2025-22964: Time-based blind SQL injection in DDSN Interactive cm3 Acora CMS version 10.1.1 DDSN Interactive cm3 Acora CMS version 10.1.1 has a time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows...

CVE-2026-36670

CVE-2026-36670 A time-based blind SQL injection exploit for the OpenSIPS Control Panel. This exploit abuses an authenticated sql injection vulnerability within the aliasmanagement.php module of opensips. The table GET parameter is improperly sanitized, allowing an attacker to inject a crafted...

CVE-2026-76289

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer REST API endpoint for lookup table...

CVE-2026-76289

Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16 are vulnerable to a Denial of Service (DoS) attack. A user without "admin" or "power" roles can make the instance unavailable by sending a request to the REST API endpoint for lookup table files. The root cause is that the endpo...

CVE-2026-76289 Denial of Service (DoS) through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk Enterprise instance unavailable to other users by sending a request to the Representational State Transfer REST API endpoint for lookup table...

CVE-2026-114143

A flaw was found in toml-node. A remote attacker could cause a Denial of Service DoS by providing specially crafted TOML input containing long dotted keys or deeply nested table headers. Processing these complex paths causes inefficient repetitive operations, consuming excessive CPU and memory...

pypdf: Possible infinite loop when hitting EOF in standard xref table

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires an incomplete file which ends inside the xref table. Patches This has been fixed in pypdf==6.20.0. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4170. Notes...

CVE-2026-113794

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0...

CVE-2026-113794 pypdf: Possible infinite loop when hitting EOF in standard xref table

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0...

CVE-2026-113794

The pypdf pure-python PDF library is vulnerable to an infinite loop (CWE-835) in versions prior to 6.20.0 . An attacker can trigger this by crafting an incomplete PDF that ends prematurely inside a standard cross-reference table , causing the library to mishandle the unexpected end of file. This ...

EUVD-2026-107335

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0...

IAT-Hook

Hooking - IAT Hooking Hooking is a technique that enables a user to redirect the execution flow of a program. Most of the time we use function hooking. We will either replace or redirect a function to our own, this is very usefull and has multiple usecases. There are multiple ways of hooking, her...

BIT-MYSQL-CLIENT-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

BIT-MARIADB-2026-92262 MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql50 bypass prefix is affected because it allows the mysql50 prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue wit...

CVE-2026-111947

The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...

CVE-2026-111947 Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication

The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...

CVE-2026-111947 Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication

The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...

EUVD-2026-107074

The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to...

CVE-2026-111947

The Pricing Table WordPress Plugin (specifically the Easy Pricing Tables plugin) is vulnerable in versions before 4.1.3 due to a lack of authorisation checks when duplicating a legacy pricing table. This flaw allows users with a contributor role or higher to clone and publish any post or page on ...