CVE-2025-50565

CVE-2025-50565 Description Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. Vulnerability Type SQL Injection Attack Type Remote Impact Information Disclosure true Has vendor confirmed true Discoverer...

CVE-2026-57555

Memory Corruption when executing system service routines due to improper handling of user input buffers...

CVE-2026-57555 Use After Free in DSP Service

Memory Corruption when executing system service routines due to improper handling of user input buffers...

CVE-2026-57555 Use After Free in DSP Service

Memory Corruption when executing system service routines due to improper handling of user input buffers...

CVE-2026-57555

A Use After Free vulnerability exists in the DSP Service due to improper handling of user input buffers during the execution of system service routines. This memory corruption flaw can lead to HIGH confidentiality, integrity, and availability impacts. Exploitation details are not provided in the ...

EUVD-2026-92983

Memory Corruption when executing system service routines due to improper handling of user input buffers...

PT-2026-106357

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Memory corruption occurs during the execution of system service routines. This issue is caused by the improper handling of user input buffers, which can lead to...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Staging: ks7010 – potential buffer overflow in kswlansetencodeext. “exc-keylen” is a u16 value provided by the user. If this value exceeds IWENCODINGTOKENMAX 64, it could lead to memory corruption...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

The poplib module, when a user-controlled command is passed to it, can have additional commands injected using newlines. Mitigation rejects commands that contain control characters...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: Prevention of out-of-bounds read in mvnetaconfigrss The value of pp-indir0 comes from the user. It is passed to the function mvnetapercpuelect. Inside this function, there is a check to ensure that the value does not...

EUVD-2026-38570

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets...

CVE-2025-15697

The Dictionary WordPress plugin (versions

PT-2026-94158

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description The plugin fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to execute Reflected...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: video: fbdev: s3fb: Check the size of the screen before memsetio In the function s3fbsetpar, the value of ‘screensize’ is calculated based on user input. If the user provides an incorrect value, the value of ‘screensize’ may be...

Astra Linux – Vulnerability in Twig

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates whose names are user-inputs. It’s possible to use the source or include statement to read arbitrary files from outside the...

CVE-2026-4103: Improper Neutralization of Input During Web Page Generation

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

DEBIAN-CVE-2026-89571

In the Linux kernel, the following vulnerability has been resolved: cxl/features: bound fwctl command payload to the input buffer fwctlcmdrpc copies cmd-inlen bytes into inbuf = kvzalloccmd-inlen and passes inbuf and inlen to -fwrpc. The CXL callback cxlctlfwrpc ignores inlen and never checks the...

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

GHSA-FXF7-VHH8-7VPQ CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Impact The FunctionsBuilder::jsonValue$field, $jsonPath methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter. Patches 5.1.10, 5.2.15, 5.3.7 Workarounds Don't provide user controlled data to these functions/parameters...

CakePHP: SmtpTransport vulnerable to CRLF header injection

Impact Custom mail headers added with Message::setHeaders or addHeaders do not have CRLF replaced allowing header injection if user controlled data is added to message headers without stripping CRLF bytes. Patches 5.3.7, 5.2.14, 5.1.9, 4.6.5, 4.5.12 contain fixes for this issue. Workarounds You c...