CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-

CVE-2026-21012 – Rust serde: deserializzazione di enum non attendibile Iniezione di variante Codice del programma Rust root@kitploit: // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminActio...

EUVD-2026-67689

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...

CVE-2025-492026

Avviso di sicurezza: CVE-2025-492026 Riepilogo È stata identificata una vulnerabilità in Copilot AI che causa l'inclusione di un collegamento ipertestuale non intenzionale nella sezione "link source" ogni volta che Copilot recupera una query web. Questo problema ha portato gli utenti a cliccare s...

CVE-2025-492025

CVE-2025-492025 Avviso di sicurezza: CVE-2025-492025 Sommario È stata identificata una vulnerabilità in Copilot AI che causa l'inclusione di un collegamento ipertestuale non intenzionale nella sezione "origine del collegamento" ogni volta che Copilot recupera una query web. Questo problema ha...

CVE-2025-32462-32463-Detection-Script-

CVE-2025-32462-32463-Detection-Script- Vulnerabilità critiche di Sudo consentono agli utenti locali di ottenere l'accesso root su Linux, con impatto sulle principali distribuzioni Una breve descrizione delle vulnerabilità è riportata di seguito - root@kitploit: CVE-2025-32462 punteggio CVSS: 2.8 ...

Astra Linux – Vulnerability in Rails

A potential information disclosure/vulnerability in Action Pack = 2.0.0, where using the redirectto or polymorphicurl helper with untrusted user input may lead to unintended method executions...

Astra Linux – Vulnerability in sudo

Before version 1.9.17p1, when the sudo command was used together with a sudoers file that specified a host that was neither the current host nor ALL, it allowed listed users to execute commands on unintended machines...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. This issue arises due to the use of the Django Template Language’s variable resolution logic. The dictsort template filter is potentially vulnerable to information disclosure, or an unintended method call...

CVE-2026-14951

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-71368

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

CVE-2026-71368

F-RevoCRM contains a stored/reflected XSS flaw; an authenticated user viewing a crafted page may have unintended actions performed on their session. CVSS 3.0 scores 6.1 MEDIUM (network, no privileges, active user interaction). No exploitation or fix details are provided in the documents. Monitor ...

CVE-2026-53797

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with ...

CVE-2025-62315

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

PT-2026-71492

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions...

CVE-2025-59321

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state. This allows the TPM to be unsealed via an unintended execution path or from another hardware platform...

PT-2026-71069

Name of the Vulnerable Software and Affected Versions CryptoPro Secure Disk for Bitlocker versions prior to 7.7.4 Description The software contains a default TPM PCR policy that fails to consider the system boot state. This flaw allows the Trusted Platform Module TPM, a specialized chip used to...

EUVD-2026-55938

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafanaapirequest tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

CVE-2025-6508

The CVE-2025-6508 entry concerns the Swagger UI Try-out console in the WSO2 API Manager’s API Publisher docs. A misbehavior allows loading an external Swagger API definition URL, which overwrites existing API definitions in the Publisher portal. This deception can lead users to interact with over...