PrestaShop debug mode allows PHP injection (CVE-2026-124916)
A back-office user who can edit debug settings can inject PHP; 9.2.1 fixes it, but affected releases are unconfirmed.
Stories per day · 30 days
1 RSS
Relatedphp2arcgis1arcgis-server1authentication-bypass1authorization-bypass1bisheng1code-injection1cve1cve-2026-167531dataelement1data-exfiltration1e-commerce1esri1idor1jwt1llm1low-code1lowcoder1
17 stories, newest first · one card per story
Stories tagged #cert
ArcGIS Server before 12.1 affected by vulnerabilities, Cyber Centre says
The October 27 notice tells administrators to review Esri’s October 2026 bulletin and apply updates when available.
Dutch NCSC takes its website offline over PHP flaws
A PHP security patch is planned for 16:00 Dutch time, and NCSC expects an advisory within an hour.
Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)
Multiple TLS libraries bypass X.509 name-constraint checks, tracked in four CVEs and three CERT/CC notes.
VU#166125: Bisheng has authentication bypass vulnerabilities
CERT/CC warns Bisheng has an unpatched SSO authentication bypass that can grant super-admin access.
5
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
CERT/CC says Lowcoder 2.4.10 lets admins or developers read and run other tenants' library queries.
3
VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1
CERT/CC details multiple Thelia 2.6.0 and 2.6.1 flaws, including admin-reachable remote code execution.
Splunk security advisory (AV26-1018)
Canada's Cyber Centre urges patches for vulnerabilities in Splunk Enterprise and Splunk MCP Server.
SonicWall security advisory (AV26-1017)
Canada's Cyber Centre warns SonicWall SMA1000 appliances through version 12.5.0 have multiple vulnerabilities and should be updated.
Arista Networks security advisory (AV26-1015)
Canada’s Cyber Centre warns Arista CloudVision CUE versions through 2026.2.0 are affected by unspecified vulnerabilities.
VU#553437: InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations
CERT warns an InsydeH2O SMM flaw in HP BIOS lets kernel attackers write arbitrary memory, including SMRAM.
SUSE Linux security advisory (AV26-968)
Canadian Cyber Centre warns SUSE NeuVector packet-capture filter command injection enables remote code execution on Kubernetes nodes; update advised.
Critical ViewSonic vCast Vulnerabilities Allow Attackers to Gain Full Control Over the Device
Unauthenticated ViewSonic vCast flaws can expose screens and install apps on ViewBoards.
ViewSonic vCast Vulnerabilities Let Attackers Gain Full Device Control Without Authentication
CERT/CC warns unauthenticated ViewSonic vCast flaws can capture screens, install apps, and fully control ViewBoards.
VU#699627: Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities
CERT/CC discloses three stored XSS flaws in Readwise Reader Android 8.7.2 that can run JavaScript in WebView.
VU#738147: Vendor-signed UEFI Shell applications allow Secure Boot bypass
CERT warns vendor-signed UEFI shells from Acer, Dell, and others can bypass Secure Boot.
2
Welcoming the Sri Lankan Government to Have I Been Pwned
Have I Been Pwned onboarded Sri Lanka as the 48th government in its free service, letting Sri Lanka CERT monitor domains for breached accounts.