CVE-2021-43936

CVE-2021-43936 CVE-2021-43936 is a critical vulnerability CVSS3 10.0 leading to Remote Code Execution RCE in WebHMI Firmware. This vulnerability works on versions 4.0 and the newest ones. Tested only on 4.0.7475. Vulnerability is used by script in the following steps: 1. Logs into the application...

Astra Linux – Vulnerability in TIF format

A null source pointer passed as an argument to the memcopy function within TIFFReadDirectory in tifdirread.c in libtiff versions from 4.0 to 4.3.0 could lead to a Denial of Service attack through a crafted TIFF file. For users who compile libtiff from source code, a fix is available in the commit...

CLSA-2026-1788348294 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post16+tuxcare...

CLSA-2026-1786021276 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post8+tuxcare...

CLSA-2025-1761696690 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post6+tuxcare...

CLSA-2025-1760659889 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post5+tuxcare...

CLEANSTART-2026-RM40472 Security fixes in cassandra-fips 4.0.19-r2

Package cassandra-fips version 4.0.19-r2 fixes 8 vulnerabilities: ghsa-3mc7-4q67-w48m, ghsa-mjmj-j48q-9wg2, ghsa-98wm-3w3q-mw94, ghsa-9w3m-gqgf-c4p9, ghsa-c4r9-r8fh-9vj2...

CVE-2026-34044

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by...

CVE-2026-34152

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to...

PT-2026-56133

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component ServerResources exposes public methods startUnmanaged, stopUnmanaged, restartUnmanaged that accept a container ID parameter directly from the browser...

CVE-2026-34049

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configur...

CVE-2026-22330 WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Right Way = 4.0 versions...

CVE-2025-14773

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24...

CVE-2025-14774

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24...

CVE-2025-14772 Broken Access Control in ABB T-MAC Plus web application

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24...

CVE-2025-14772 Broken Access Control in ABB T-MAC Plus web application

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24...

ABB T-MAC Plus cross-site scripting vulnerabilities

ABB T-MAC Plus is a shipboard equipment status monitoring and predictive maintenance management system developed by the Swiss company ABB. Version 4.0-24 of ABB T-MAC Plus contains a cross-site scripting vulnerability, which stems from improper input handling and may lead to cross-site scripting...

Apache Syncope security vulnerability

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration, and more. A security vulnerability exists in Apache Syncope versions 3.0 through...

CVE-2026-8220 Devs Palace ERP Online customer-save cross site scripting

A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /inventory/customer-save. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted ear...

Moodle cross-site scripting vulnerabilities

Moodle is an open-source e-learning software platform developed by Moodle, also known as a course management system, learning management system, or virtual learning environment. Version 4.0 of Moodle has a cross-site scripting vulnerability. This vulnerability stems from the search parameters...