🚨 CVE-2026-52469
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
🎖@cveNotify
GitHub
CVE/Crocus/SQL Injection-1.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52470
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
🎖@cveNotify
GitHub
CVE/Crocus/SQL Injection-2.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52472
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
🎖@cveNotify
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
🎖@cveNotify
GitHub
CVE/Wgcloud/SQL-Injection-1.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52474
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
🎖@cveNotify
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
🎖@cveNotify
GitHub
CVE/AiFlowy/Any SpringBean invocation.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52475
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file
🎖@cveNotify
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file
🎖@cveNotify
GitHub
CVE/AiFlowy/Any file upload vulnerability.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-52476
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
🎖@cveNotify
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
🎖@cveNotify
GitHub
CVE/AiFlowy/SQL Injection.md at main · Y4y17/CVE
Contribute to Y4y17/CVE development by creating an account on GitHub.
🚨 CVE-2026-63047
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
🎖@cveNotify
The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
🎖@cveNotify
Joomdonation
Events Booking
Events Booking is a Joomla events registration / events manager extension. It allows you to create, display events, handle registration, get paid from registrants via online payment gateways.
🚨 CVE-2026-63048
The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.
🎖@cveNotify
The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE.
🎖@cveNotify
JoomlaCK - Extensions et tutoriels Joomla!
Extensions et documentations Joomlack
Téléchargez des extensions pour joomla, modules, plugins, ou composant. Vous pouvez également télécharger des tutoriels et livres pour créer votre template Joom
🚨 CVE-2026-63264
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
🎖@cveNotify
The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.
🎖@cveNotify
🚨 CVE-2026-57599
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.
🎖@cveNotify
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.
🎖@cveNotify
🚨 CVE-2026-57600
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.
🎖@cveNotify
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.
🎖@cveNotify
🚨 CVE-2026-61390
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
🚨 CVE-2026-61391
There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets.
🎖@cveNotify
🚨 CVE-2026-61392
There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.
🎖@cveNotify
There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.
🎖@cveNotify
🚨 CVE-2026-16232
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
🎖@cveNotify
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
🎖@cveNotify
Checkpoint
sk185169 - CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token
Applies to: Multi-Domain Security Management, Security Management
🚨 CVE-2026-53910
diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.
When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.
An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.
This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815
🎖@cveNotify
diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.
When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.
An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.
This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815
🎖@cveNotify
cert.pl
Vulnerability in GNU diffutils software
Integer Overflow vulnerability (CVE-2026-53910) has been found in GNU diffutils software.
🚨 CVE-2026-62144
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
🎖@cveNotify
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
🎖@cveNotify
Checkpoint
sk185152 - CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation
Applies to: Multi-Domain Security Management, Security Management
🚨 CVE-2026-62145
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
🎖@cveNotify
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
🎖@cveNotify
Checkpoint
sk185153 - CVE-2026-62145 - Local privilege escalation in Gaia Portal
Applies to: Security Gateways, Security Management
🚨 CVE-2026-14985
The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.
🎖@cveNotify
The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script.
🎖@cveNotify
kb.cert.org
CERT/CC Vulnerability Note VU#360868
Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability
🚨 CVE-2026-16606
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
🎖@cveNotify
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
🎖@cveNotify
global.fujitsu
Fujitsu BS2000 Software Integration
Die Produktsuite openSEAS unterstützt die Anwendungsintegration von BS2000-Applikationen hin zu modernen Kommunikationsmitteln. Somit ist der Anschluss ans Internet, Application Server und mobile Geräte möglich.
🚨 CVE-2026-16607
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
🎖@cveNotify
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
🎖@cveNotify
global.fujitsu
Fujitsu BS2000 Software Integration
Die Produktsuite openSEAS unterstützt die Anwendungsintegration von BS2000-Applikationen hin zu modernen Kommunikationsmitteln. Somit ist der Anschluss ans Internet, Application Server und mobile Geräte möglich.