CVE-2018-25185

CVE-2018-25185 affects Wecodex Restaurant CMS 1.0. An SQL injection via the username parameter in the login endpoint permits unauthenticated attackers to manipulate queries and extract data using boolean-based or time-based blind techniques. Public references describe the vulnerability and show a...

CVE-2018-25185

Wecodex Restaurant CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the username parameter. Attackers can send POST requests to the login endpoint with malicious SQL payloads using boolean-based blin...

firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the WebRTC: Signaling component...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine component...

firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the WebRTC: Signaling component...

firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the WebRTC: Signaling component...

firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the WebRTC: Signaling component...

firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Undefined behavior in the WebRTC: Signaling component...

DEBIAN-CVE-2026-23397

In the Linux kernel, the following vulnerability has been resolved: nfnetlinkosf: validate individual option lengths in fingerprints nfnlosfaddcallback validates optnum bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nfosfmatchone ...

CVE-2026-23397 nfnetlink_osf: validate individual option lengths in fingerprints

In the Linux kernel, the following vulnerability has been resolved: nfnetlinkosf: validate individual option lengths in fingerprints nfnlosfaddcallback validates optnum bounds and string NUL-termination but does not check individual option length fields. A zero-length option causes nfosfmatchone ...

CVE-2026-23397

CVE-2026-23397 affects the Linux kernel nfnetlink_osf fingerprint matching. The issue arises when parsing TCP option fingerprints: add-time checks for option lengths are insufficient, allowing a zero-length option to bypass bounds checks and potentially trigger a fault in nf_osf_match_one() (kern...

CVE-2026-4247

creationtimestamp| type| source ---|---|--- 2026-03-26 09:08:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxaxo55sy2t 2026-03-27 00:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhystcceec2r 2026-03-27 00:01:30+00:00| seen|...

ksmbd: Compare MACs in constant time

...

net: phy: register phy led_triggers during probe to avoid AB-BA deadlock

...

BentoML has Dockerfile Command Injection via system_packages in bentofile.yaml

Summary The docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since systempackages is semantically a list of OS package names data, users do not expect values to be interpreted as shell command...

WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites

Cybersecurity researchers have discovered a new payment skimmer that uses WebRTC data channels as a means to receive payloads and exfiltrate data, effectively bypassing security controls. "Instead of the usual HTTP requests or image beacons, this malware uses WebRTC data channels to load its...

EUVD-2026-16106

The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the leafext-cookie-time and leafext-delete-cookie shortcodes in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on...

CVE-2026-4835

creationtimestamp| type| source ---|---|--- 2026-03-26 06:28:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwxynbsxv27...

CVE-2026-4389

The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the leafext-cookie-time and leafext-delete-cookie shortcodes in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on...

CVE-2026-4281

creationtimestamp| type| source ---|---|--- 2026-03-26 04:16:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4281 2026-03-26 06:48:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwz4gyfxf2g...