A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
PLANKA versions 2.2.0 and 2.2.1 contain a vulnerability in the two-factor authentication process where the system fails to limit the number of incorrect TOTP codes submitted to the verification endpoint. This allows an attacker who already knows a user's password to brute force the six-digit TOTP codes by reusing a valid pending token within a ten-minute window, potentially obtaining a full access token.
A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formwork/src/Sanitizer/DomSanitizer.php of the component URI Sanitizer. Such manipulation of the argument formaction leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.3.13 is recommended to address this issue. The name of the patch is 729701e59c5886685c5a1d477bdc3035e41f18b1. Upgrading the affected component is advised.
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.
A vulnerability in External Secrets Operator's webhook generator allows bypassing label enforcement, enabling unauthorized secret exfiltration. The bug causes the label-enforcement flag to be cleared incorrectly, skipping a critical check that ensures secrets are properly labeled for webhook use. An attacker with permission to create webhook generators can exploit this to exfiltrate secrets not intended for webhook access. The issue affects versions from 0.10.0 up to but not including 1.3.2. A patch is available to fix this flaw. Mitigations include disabling webhook generators if unused, restricting RBAC permissions, enforcing label policies, and limiting egress network access from controller pods.
Dell Container Storage Modules prior to version 1.18.0 have a missing authorization vulnerability in the Dell CSI Driver for PowerMax component (csireverseproxy). This flaw allows an unauthenticated attacker with adjacent network access to potentially gain unauthorized access. The vulnerability is tracked as CVE-2026-63691 and has a medium severity rating with a CVSS score of 6.1.
### Impact
Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
### Patches
Payload now applies field-level access checks to sort fields before executing queries.
Users should upgrade to `>= 3.88.0` or `>= 4.0.0-canary.27`.
### Workarounds
Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
### Impact
The password-hashing configuration used a lower work factor than what is recommended.
### Patches
Payload now uses stronger password-hashing parameters and transparently upgrades older hashes following a successful login.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
### Workarounds
Upgrading is recommended. Until you can upgrade, protect database copies and backups from unauthorized access and require strong, unique passwords.
A memory corruption vulnerability exists in Vyper versions prior to 0.2.6 when performing function calls inside tuples or nested function calls. This occurs due to an incorrect pointer to the tip of the stack during such calls. The issue was fixed in Vyper version 0.2.6.
A vulnerability in Vyper prior to version 0.2.6 causes call stack corruption when passing multi-dimensional arrays as arguments to internal or external functions. This occurs due to incorrect assumptions about the size of array or struct subtypes during stack management, leading to incorrect output.
Scammers are exploiting the anticipation for the upcoming Grand Theft Auto VI (GTA VI) release by creating fake websites that offer early access, leaked versions, or preorder codes for the game. These sites lure gamers with promises of paid early builds, demos, or exclusive content, often demanding cryptocurrency payments or personal data. Some scams involve fake crowdfunding campaigns or advertising offers within the game. Others require users to download suspicious software under the guise of 'human verification.' These fraudulent schemes aim to steal money, personal information, or infect devices with malware. No legitimate early access or leaked versions are available, and users are advised to avoid interacting with such sites or downloading unknown files.
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
A vulnerability in Vyper versions from 0.1.0b10 up to but not including 0.2.3 causes a transaction revert when a return statement is used inside a for loop nested more than one level deep in internal calls. This results in an invalid jump destination and a stack underflow error. The impact is minor and mainly causes unnecessary transaction reverts, but under certain conditions, it could lead to a denial-of-service (DoS) on public contracts. The issue is fixed in Vyper 0.2.3.
Dell Container Storage Modules (CSM) versions prior to 1.18.0 have a vulnerability due to missing authentication in the csm-authorization-tenant gRPC service. This flaw allows an unauthenticated adjacent network attacker to create tenant entities, inject roles across tenants, and modify storage access control flags without authorization. The vulnerability is classified as CWE-306 and carries a high severity with a CVSS score of 7.1.
CVE-2026-105800 is a Server-Side Request Forgery (SSRF) vulnerability in the i18next-http-backend library. It occurs when an attacker controls the language or namespace input that is interpolated into the loadPath template, allowing injection of a colon character that causes the backend to request an unintended origin. This vulnerability affects versions of i18next-http-backend prior to 4.0.2 and was caused by an incomplete patch for a previous related vulnerability. The issue is fixed by rejecting colon characters in language and namespace values and ensuring URLs remain within the intended origin.
A recent campaign uses fake websites impersonating ChatGPT, Gemini, Claude, and Perplexity to steal advertising account credentials and multi-factor authentication (MFA) codes. These sites employ browser-in-browser attacks to deceive users into revealing sensitive login information. The campaign specifically targets ad account managers, aiming to compromise their accounts through credential theft and MFA bypass techniques.
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Dell Container Storage Modules versions prior to 1.18.0 have a vulnerability involving the use of insufficiently random values. This flaw could be exploited by an unauthenticated attacker with local access to cause information tampering. The vulnerability is classified as high severity with a CVSS score of 7.7.