BLSOPS

Latest CVEs · RSS

• CVE-2026-79957 2026-10-14 · CVSS 8.1
  ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the requ
• CVE-2026-14967 2026-07-08 · CVSS 3.1
  BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not res
• CVE-2026-14966 2026-07-08 · CVSS 3.1
  BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing ca
• CVE-2026-12568 2026-06-17 · CVSS 6.5
  The postman_download module uses the workspace name field from the Postman API to construct the local directory path without sanitization. If a malicious worksp
• CVE-2026-12567 2026-06-17 · CVSS 2.2
  The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the
• CVE-2026-12566 2026-06-17 · CVSS 3.1
  The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An
• CVE-2026-12565 2026-06-17 · CVSS 5.3
  The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of extern
• CVE-2026-10880 2026-06-04 · CVSS 9.8
  OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into
• CVE-2026-2103 2026-02-06 · CVSS 7.1
  Infor SyteLine ERP uses hard-coded static cryptographic keys to encrypt stored credentials, including user passwords, database connection strings, and API keys.
• CVE-2025-12463 2025-11-03 · CVSS 9.8
  An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` s
• CVE-2025-10284 2025-10-09 · CVSS 9.6
  BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote c
• CVE-2025-10283 2025-10-09 · CVSS 9.6
  BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
• CVE-2025-10282 2025-10-09 · CVSS 4.7
  BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
• CVE-2025-10281 2025-10-09 · CVSS 4.7
  BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
• CVE-2025-10183 2025-09-09 · CVSS 9.1
  A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary
• CVE-2025-6002 2025-06-11 · CVSS 7.2
  An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary
• CVE-2025-6001 2025-06-11 · CVSS 8.3
  A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacker
• CVE-2025-1888 2025-03-14 · CVSS 4.6
  The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting (XSS). An authenticated user can access the sl
• CVE-2023-3434 2023-07-14 · CVSS 4.4
  Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami (version 20222284) on Windows. This allows an attacker to send a custom
• CVE-2023-3433 2023-07-14 · CVSS 5.5
  The "nickname" field within Savoir-faire Linux's Jami application is susceptible to a failed state when a user inserts special characters into the field. When p