GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

Portabilis i-Educar Tipos de usuàrio educar_tipo_usuario_lst.php sql injection

A vulnerability has been found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_usuario_lst.php of the component Tipos de usuàrio Page. Such manipulation of the argument nm_tipo/descrição leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 2.12 mitigates this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced."

Missing permission checks allow frontend users to edit or delete arbitrary accounts in TYPO3 femanager

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts.

Frontend User Account Manipulation via femanager Extension in TYPO3

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.

Mbed TLS Vulnerability Allowing Unadvertised Group During TLS 1.3 HelloRetryRequest

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.

Directory Traversal Vulnerability in Paessler PRTG Network Monitor

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.

Sensitive Information Leak via Debugging Code in Samsung Exynos Camera Driver

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code.

Directory Traversal in DataEase Static Resource Controller Exposes Sensitive Files

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component.

The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.

Body Class Injection XSS in Paessler PRTG Network Monitor

A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.

PRTG FTP Server Count Sensor Remote File Write

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.

Out‑of‑Bounds Write in Samsung Exynos DPU Driver Enables Kernel Privilege Escalation

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. An out-of-bounds write vulnerability in the Exynos DPU driver (due to missing input length validation in color mode LUT parsing) leads to kernel memory corruption and potential privilege escalation.

Malformed IOCTL Buffer Overflow in Samsung Exynos Wi-Fi Driver Leading to Denial of Service

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, resulting in an out-of-bounds write and causing a denial of service (DoS).

Unauthorised Project Transfer Allowance in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

SQL Server Elevation of Privilege Vulnerability

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

SQL Server Elevation of Privilege Vulnerability

Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network.

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.

Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself or one of its descendants, while the folder tree walks used by DELETE /api/v1/folders/{id} and POST /api/v1/folders/{id}/read did not track visited folder identifiers. An authenticated user could persist a parent cycle and start a request that consumed CPU and memory indefinitely, with the condition remaining stored until repaired. This issue is fixed in version 0.11.1.

SQL Server Elevation of Privilege Vulnerability

Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network.

SQL Server Elevation of Privilege Vulnerability

Use after free in SQL Server allows an authorized attacker to elevate privileges locally.