CVE-2026-27736 BigBlueButton has Open Redirect vulnerability in ApiController

BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No...

EUVD-2026-8636

In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint. The field lacked validation which could potentially result in ways to circumvent expected workflows...

CVE-2026-0704

CVE-2026-0704 (Octopus Deploy) is described across multiple sources as a vulnerability where a lack of input validation on an API endpoint could allow removing files or their contents on the host, potentially bypassing workflows. The affected product is consistently identified as Octopus Deploy; ...

PT-2026-21960

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.20 Description BigBlueButton is a virtual classroom platform. Versions of the 3.x branch before 3.0.20 contain an Open Redirect issue. The errorRedirectUrl string is not properly validated, and is directly...

rustfs 安全漏洞

RustFS is a high-performance object storage system developed by RustFS. Versions of RustFS from 1.0.0-alpha.56 to 1.0.0-alpha.82 contain security vulnerabilities. These vulnerabilities stem from unvalidated pre-signed POST uploads, which may allow bypassing content length limits, start conditions...

Bugsink 跨站脚本漏洞

Bugsink is an open-source, self-hosted bug tracking software developed by Bugsink. Versions of Bugsink prior to 2.0.13 contained a cross-site scripting vulnerability. This vulnerability stemmed from unvalidated attackers who could submit events to the project, allowing them to store arbitrary...

GitLab CE/EE 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. Versions of GitLab CE/EE prior to 18.7.5, 18.8.5, and 18.9.1 containe...

FreeRDP 缓冲区错误漏洞

FreeRDP is an open source implementation of the Remote Desktop Protocol RDP from the FreeRDP team. FreeRDP suffers from a buffer overflow vulnerability that stems from unvalidated target rectangle boundaries in the GDI surface pipeline, which can be exploited by an attacker to cause a heap buffer...

The vulnerability of the sata_pmp_init_links() function in the drivers/ata/libata-pmp.c kernel module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the satapmpinitlinks function in the drivers/ata/libata-pmp.c kernel module of the Linux operating system is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protect...

Exploit for CVE-2026-26198

versions 0.9.9 through 0.22.0, when performing Vulnerability...

CVE-2026-26198

Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into sqlalchemy.text without any validation or sanitization. The min and max methods in the QuerySet class...

CVE-2026-26198

Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into sqlalchemy.text without any validation or sanitization. The min and max methods in the QuerySet class...

CVE-2026-26198

Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into sqlalchemy.text without any validation or sanitization. The min and max methods in the QuerySet class...

NETIKUS EventSentry 安全漏洞

NETIKUS EventSentry is a network monitoring software developed by the American company NETIKUS. Versions of NETIKUS EventSentry prior to 6.0.1.20 contained security vulnerabilities. These vulnerabilities stemmed from the unvalidated password change mechanism in the account management feature of t...

DEBIAN-CVE-2026-21863

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the system crashing. The Valkey clusterbus packet processin...

Valkey 缓冲区错误漏洞

Valkey is a flexible distributed key-value database developed by Valkey OpenSource. Versions prior to Valkey 9.0.2, 8.1.6, 8.0.7, and 7.2.12 contain a buffer error vulnerability. This vulnerability arises from the lack of validation of extended data packet positions in the cluster bus data packet...

WordPress plugin ElementsKit Lite 访问控制错误漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

CVE-2026-1369

The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

CVE-2026-1369 Conditional CAPTCHA <= 4.0.0 - Open Redirect

The Conditional CAPTCHA WordPress plugin through 4.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

CVE-2026-27020

Photobooth prior to 1.0.1 has a cross-site scripting XSS vulnerability in user input fields. Malicious users could inject scripts through unvalidated form inputs. This vulnerability is fixed in 1.0.1...