EUVD-2026-63403

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

CVE-2026-56654

A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

Azure Arc Elevation of Privilege Vulnerability

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

Microsoft Entra ID Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

Azure SQL Database Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

Azure Data Factory Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63323

HCL IntelliOps Event Management IEM is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation...

EUVD-2025-210753

HCL IntelliOps Event Management IEM is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges...

EUVD-2026-63224

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

kernel: smb: client: mask server-provided mode to 07777 in modefromsid

A flaw was found in the Linux kernel's Server Message Block SMB client. When processing server-provided file mode information, the system incorrectly applies these modes without proper security masking. This can result in unintended file permissions, potentially allowing unauthorized access to...

kernel: smb: client: mask server-provided mode to 07777 in modefromsid

A flaw was found in the Linux kernel's Server Message Block SMB client. When processing server-provided file mode information, the system incorrectly applies these modes without proper security masking. This can result in unintended file permissions, potentially allowing unauthorized access to...

CVE-2026-76341

creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:49+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

Splunk <=7.0.1 - Information Disclosure

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. id: CVE-2018-11409 info: name: Splunk =7.0.1 - Information Disclosure author: harshbothra severity: medium...

Joomla! <3.7.1 - SQL Injection

Joomla! before 3.7.1 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2017-8917 info: name: Joomla! 3.7.1 - SQL Injection...

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

Geutebruck - Remote Command Injection

Geutebruck is susceptible to multiple vulnerabilities its web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-33544 info: name: Geutebruck - Remote Command Injection author: gy741 severit...

VMware vSphere - Server-Side Request Forgery

VMware vSphere HTML5 is susceptible to server-side request forgery due to improper validation of URLs in a vCenter Server plugin. An attacker with network access to port 443 can exploit this issue by sending a POST request to the plugin. This affects VMware vCenter Server 7.x before 7.0 U1c, 6.7...

Agentejo Cockpit <0.11.2 - NoSQL Injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function of the Auth controller. id: CVE-2020-35847 info: name: Agentejo Cockpit 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critical description: | Agentejo Cockpit before 0.11.2 allows NoS...

Joomla! JCK Editor SQL Injection

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. id: CVE-2018-17254 info: name: Joomla! JCK Editor SQL Injection author: SumanKar severity: critical description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection vi...