CVE-2026-30332

A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...

PT-2026-29795

A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...

CVE-2026-30332

Balena Etcher for Windows versions before 2.1.4 is vulnerable to a TOCTOU race during flashing. An attacker can replace a temporary .cmd file created in a user-writable temp directory with a crafted payload, which is then executed with elevated privileges via Windows UAC, allowing privilege escal...

CVE-2026-30332

A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...

CVE-2026-28805: Improper Neutralization of Special Elements used in an SQL Command

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the optionsstato GET parameter. The user-supplied value is read from...

PT-2026-36427

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where bpf kprobe multi link attach fails to validate if a program being attached has the sleepable flag set. Because kprobe.multi programs operate...

CVE-2026-30332

A Time-of-Check to Time-of-Use TOCTOU race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escalate privileges and execute arbitrary code via replacing a legitimate script with a crafted payload during the flashing process...

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Summary Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the saveexternaldata function. An attacker can overwrite arbitrary files or inject data into sensitive locations by exploiting a race...

GHSA-4VXV-4XQ4-P84H

creationtimestamp| type| source ---|---|--- 2026-04-01 23:28:03+00:00| seen| Telegram/9GieXm2mvI1hTc72mHyuKx2RXs9Lk1GMse1mK9qILNsF30...

CVE-2026-25835

creationtimestamp| type| source ---|---|--- 2026-04-01 21:40:00+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mihnqjndcd2l 2026-04-02 05:26:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miihs2siqs2s...

OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

Description Multiple AJAX select handlers in OpenSTAManager = 2.10.1 are vulnerable to Time-Based Blind SQL Injection through the optionsstato GET parameter. The user-supplied value is read from $superselect'stato' and concatenated directly into SQL WHERE clauses as a bare expression, without any...

GHSA-3GW8-3MG3-JMPC OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

Description Multiple AJAX select handlers in OpenSTAManager = 2.10.1 are vulnerable to Time-Based Blind SQL Injection through the optionsstato GET parameter. The user-supplied value is read from $superselect'stato' and concatenated directly into SQL WHERE clauses as a bare expression, without any...

VulnHawk

🛡️ VulnHawk — OWASP Top 10 Web Vulnerability Scanner...

CVE-2026-34224

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple...

CVE-2026-3877

creationtimestamp| type| source ---|---|--- 2026-04-01 15:26:18+00:00| published-proof-of-concept| Telegram/olwODmUlHzKZbEJSW7LVNU33CLgdNztsPJfFMY6W51dkA 2026-04-01 15:48:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mih245az3x23...

CVE-2026-22767

creationtimestamp| type| source ---|---|--- 2026-04-01 15:23:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3migypf3ceh2n 2026-04-01 15:25:59+00:00| seen| Telegram/4u6pNJfi3nLv5HBYbkAVRO5hA7CasKnKFj2guWNAP2iZfQ 2026-04-01 16:09:03+00:00| seen|...

CVE-2026-4927

Devolutions Server versions 2026.1.6 through 2026.1.11 are vulnerable to an information disclosure flaw in the multi-factor authentication (MFA) feature. The root cause is the exposure of sensitive information during the processing of authenticated API requests. This allows users possessing user ...

CVE-2026-4927

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11...

CVE-2026-4927

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11...