CVE-2026-57821 Apache Fineract: Office list: SQL Injection via Subquery in orderBy

A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...

CVE-2026-57821 Apache Fineract: Office list: SQL Injection via Subquery in orderBy

A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...

CVE-2026-57821

A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...

CVE-2026-57821

Apache Fineract versions up to and including 1.14.0 are vulnerable to a SQL Injection in the Office Search API (GET /api/v1/offices). The root cause is the insufficient validation of the orderBy request parameter, which is concatenated directly into a SQL query. This is a bypass of the ColumnVali...

firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the DOM: Core & HTML component...

SUSE CVE-2026-59869

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

MAL-2026-10654 Malicious code in @debile/require-dir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3075732c05c8b941b57fed9e8fe9c788b28f9ff6fe9ef91936d1802f568c594e Package @debile/require-dir republishes the code of the well-known require-dir package under a different scope. Its package.json preinstall script ru...

CVE-2026-13585

creationtimestamp| type| source ---|---|--- 2026-07-15 03:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnsjokhz42c 2026-07-15 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-16 06:28:08+00:00| seen|...

CVE-2026-8919

Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the application’s local service endpoint. This can result in...

CVE-2026-42049

creationtimestamp| type| source ---|---|--- 2026-07-15 02:13:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnnimr6di26...

EUVD-2026-44531

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service...

CVE-2025-56364

creationtimestamp| type| source ---|---|--- 2026-07-15 00:00:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqng325btt2z 2026-07-27 08:48:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmj6r7uog2m 2026-07-27 08:53:06+00:00| seen|...

CVE-2026-61371

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via OTRUNC, and can happen before full input validation completes “truncation-before-validation...

AlmaLinux 8 : kernel-rt (ALSA-2026:39180)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:39180 advisory. kernel: net: bridge: use a stable FDB dst snapshot in RCU readers CVE-2026-46086 kernel: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete...

CVE-2026-57821: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in Apache Fineract's Office Search API GET /api/v1/offices in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to...

CVE-2026-61371

Microsoft AVML versions prior to 0.17.0 are vulnerable to a truncation-before-validation flaw on Unix systems. The software can follow a symlink when opening a destination output path, enabling an attacker to trigger a destructive truncation or overwrite of the symlink target. This occurs at open...

PT-2026-58896

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An authenticated user with permissions to view offices can perform a time-based blind SQL injection via the 'Office Search API' endpoint '/api/v1/offices'. The issue occurs because the order...

PT-2026-60122

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality checks to infer valid credentials through precise timing...

PT-2026-60266

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side...

RHEL 9 : kernel-rt (RHSA-2026:39983)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39983 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...