🚨 CVE-2026-67687
Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java
🎖@cveNotify
Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java
🎖@cveNotify
GitHub
CVE-2026-67687-ICS-Park-Smart-Park-Management-System-v2.0/CVE-2026-67687 at main · qflksheep/CVE-2026-67687-ICS-Park-Smart-Park…
ICS-Park Smart Park Management System v2.0. Contribute to qflksheep/CVE-2026-67687-ICS-Park-Smart-Park-Management-System-v2.0 development by creating an account on GitHub.
🚨 CVE-2026-67688
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code.
🎖@cveNotify
ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code.
🎖@cveNotify
GitHub
CVE-2026-67687-ICS-Park-Smart-Park-Management-System-v2.0/CVE-2026-67688 at main · qflksheep/CVE-2026-67687-ICS-Park-Smart-Park…
ICS-Park Smart Park Management System v2.0. Contribute to qflksheep/CVE-2026-67687-ICS-Park-Smart-Park-Management-System-v2.0 development by creating an account on GitHub.
🚨 CVE-2026-67689
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints
🎖@cveNotify
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints
🎖@cveNotify
GitHub
CVE-2026-67689-FineAdmin.Mvc-vulnerability/CVE-2026-67689-ORDER BY Clause SQL Injection at main · qflksheep/CVE-2026-67689-FineAdmin.Mvc…
Contribute to qflksheep/CVE-2026-67689-FineAdmin.Mvc-vulnerability development by creating an account on GitHub.
🚨 CVE-2026-12261
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.
🎖@cveNotify
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of package-isolated roots, and validates package integrity only after the archive has been written and extracted. This design flaw enables one package to overwrite another package's trusted resources within the same namespace, making the changes immediately active through ordinary NLTK APIs. This issue persists across fresh interpreter restarts and can affect downstream workflows, including machine learning pipelines and reproducibility-sensitive environments.
🎖@cveNotify
🚨 CVE-2026-37171
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
🎖@cveNotify
A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
🎖@cveNotify
Whitenbaker
CVE-2026-37171 — Cross-Tenant Session Trust in SuperTokens Core | Whitenbaker
Security advisory CVE-2026-37171: SuperTokens Core accepts a session’s embedded tenant claim without validating it against the request’s tenant context, collapsing isolation between tenants. Affects Core v6.0.0–v11.4.0.
🚨 CVE-2025-63235
In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.
🎖@cveNotify
In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.
🎖@cveNotify
GitHub
Five bugs in sol · Issue #12 · codepr/sol
Hi,codepr!I found five bugs in sol. Environment Details 1.sol version: Commit # 373d848 2.Operating system and version:Kali GNU/Linux Rolling 2023.4
🚨 CVE-2026-12372
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.
🎖@cveNotify
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.
🎖@cveNotify
🚨 CVE-2026-72522
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
🎖@cveNotify
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
🎖@cveNotify
bugzilla.mozilla.org
Access Denied
You are not authorized to access bug 2053153. To see this bug, you must
first log in to an account with the appropriate permissions.
first log in to an account with the appropriate permissions.
🚨 CVE-2026-16053
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
🎖@cveNotify
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
🎖@cveNotify
ManageEngine M365 Manager Plus
Microsoft 365 management, reporting, and auditing - ManageEngine M365 Manager Plus
🚨 CVE-2026-51583
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.
🎖@cveNotify
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.
🎖@cveNotify
Gist
CVE-2026-51583
CVE-2026-51583. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-51584
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.
🎖@cveNotify
An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.
🎖@cveNotify
Gist
CVE-2026-51584
CVE-2026-51584. GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2026-18125
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
🎖@cveNotify
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
🎖@cveNotify
🚨 CVE-2026-18127
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
🎖@cveNotify
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.
🎖@cveNotify
🚨 CVE-2026-18129
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
🎖@cveNotify
Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections.
🎖@cveNotify
🚨 CVE-2026-12571
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
🎖@cveNotify
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
🎖@cveNotify
ManageEngine
Security Updates - CVE Database | ManageEngine DDI Central
List of security vulnerabilities fixed in DDI Central This page lists security vulnerability fixes made in various releases of DDI Central and vulnerability details. Go to ManageEngine's Security Response Center to report vulnerabilities on ManageEngine products.…
🚨 CVE-2026-73281
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
🎖@cveNotify
In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the session-bind@openssh.com extension.
🎖@cveNotify
www.openssh.org
OpenSSH: Release Notes
OpenSSH release notes
🚨 CVE-2026-73282
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
🎖@cveNotify
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
🎖@cveNotify
www.openssh.org
OpenSSH: Release Notes
OpenSSH release notes
🚨 CVE-2026-73283
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
🎖@cveNotify
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not.
🎖@cveNotify
www.openssh.org
OpenSSH: Release Notes
OpenSSH release notes
🚨 CVE-2026-6484
In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.
🎖@cveNotify
In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.
🎖@cveNotify
Insyde Software
SA-2026003
🚨 CVE-2025-59319
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege.
🎖@cveNotify
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege.
🎖@cveNotify
🚨 CVE-2025-59320
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM.
🎖@cveNotify
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker with physical access to the system disk can recover this information and craft an environment to unseal the TPM.
🎖@cveNotify