WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Navidrome <=0.54.5 - Authentication Bypass in Subsonic API

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

EUVD-2026-67934

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Riepilogo È stata scoperta una vulnerabilità critica di SQL Injection nel progetto Online Shopping System Advanced di PuneethReddyHC. Il difetto risiede in action.php, che non riesce a sanitizzare adeguatamente l'inp...

PT-2026-83361

Name of the Vulnerable Software and Affected Versions mongosqld affected versions not specified Description When configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one. This allows clients that provide no...

CVE-2026-81522 Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

CVE-2026-81522

CVE-2026-81522 affects the MongoDB C++ Driver and involves improper handling of caller-supplied namespace identifiers. The root cause is that special characters—specifically dot and NUL characters —embedded in those identifiers can cause an application's operation to be directed at a different da...

Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by vulnerabilities

Summary IBM Java 17 is used by IBM Sterling Connect:Direct for UNIX in product configuration and data transmission. IBM Sterling Connect:Direct for UNIX is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct for UNIX has upgraded IBM Java 17 to address the issues CVE-2026-3428...

CVE-2021-27905

CVE-2021-27905 Server Side Request Forgery SSRF di Apache Solr ReplicationHandler Hit Counter Apache Solr che sta per Searching On Lucene with Replication è un motore di ricerca gratuito e open-source basato sulla libreria Apache Lucene. Scritto in Java. Apache Solr dispone di API RESTful XML/HTT...

TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0926)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0926 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: java-17-openjdk (TSSA-2026:0928)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0928 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-15366

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093262)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093262 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Encryption. Supported versions that are affected are 5.6.45 and prior and 5.7....

CVE-2026-78581

CVE-2026-78581 is an authorization bypass (CWE-639) in Kibana affecting the AI Assistant feature. An authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-g...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Networking. The supported versions affected by this vulnerability include Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle...

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and...

Oracle Business Intelligence Enterprise Edition (OAS 8.2) (August 2026 CSPU)

The version of Oracle Business Intelligence Enterprise Edition OAS 8.2.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Web Service API...

CVE-2026-54624 django CMS: Structure endpoint bypasses page-view permission

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

Linux Distros Unpatched Vulnerability : CVE-2026-71136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-71115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...