CVE-2026-61425Jul 21, 2026
The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access.
The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.
The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element.
nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue.
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation, allowing authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. An attacker could modify the service ID value in the client-side request and successfully create a ticket associated with a
Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, when using a daemon configured with a chroot, the reverse DNS lookup of the connecting client was performed after the chroot had been entered. If the chroot did not contain the files glibc needs for resolution (/etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts, NSS service modules), the lookup failed and the connecting hostname was set to "UNKNOWN". Hostname-based
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection. This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3.
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153.
Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153.
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153.
Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153.
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153.
Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153.
Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153.
Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.
A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.