CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

BIT-MOODLE-2026-102578 Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

Astra Linux – Vulnerability in SQLite3

SQLite 3.30.1 improperly handles certain SELECT statements involving a non-existent VIEW, resulting in an application crash...

Astra Linux – Vulnerability in SQLite3

The flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN where the right-hand side is a view. This can lead to a NULL pointer dereference or incorrect results...

Astra Linux – Vulnerability in Chromium

The use of after-free in the Guest View component in Google Chrome before version 149.0.7827.103 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid lock inversion when pinning to GGTT on CHV/BXT+VTD After i915vmapinww is completed, a synchronous variant of dmafenceworkcommit is called. When pinning a VMA to GGTT address space on a Cherry View family processor...

CVE-2026-104706

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706 Mitel MiVoice Office 400 view system files path traversal

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

EUVD-2026-92289

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-104706

The Mitel MiVoice Office 400 system is affected by a path traversal vulnerability (CWE-31). This flaw allows an attacker with high privileges to view or download sensitive system files via the portal at https://:8443 specifically through the Administration -> View Logs menu. The vulnerability ...

PT-2026-104743

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:8443 via menus Administration - View Logs...

CVE-2026-105693: Missing Authorization

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row for a file even when the caller authenticated with only one scoped share link. A holder of a restrictive link can obtain other links' secret IDs, pa...

CVE-2026-104706: Path Traversal: 'dir\..\..\filename'

DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https:// :8443 via menus Administration - View Logs...

PT-2026-106214

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists in the unauthenticated get-view-only-bundle RPC Remote Procedure Call that returns all share-link rows for a file, regardless of whether the caller authenticated with a single scoped...

CVE-2026-102775: Authorization Bypass Through User-Controlled Key

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

Linux Distros Unpatched Vulnerability : CVE-2026-104874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items,...

WordPress WPC Smart Quick View for WooCommerce plugin <= 4.4.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WPC Smart Quick View for WooCommerce versions = 4.4.0...

CVE-2026-103888

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103888

The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 4.4.0 . The root cause is insufficient input sanitization and output escaping of the 'woosq-redirect' parameter. Unauthenticated attackers can in...