The EU CRA's Real Question: What Shipped, and When Did You Know?
More on Question
Other advisories
- Not ratedosv:CVE-2026-116183phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
- Not ratedosv:CVE-2026-111904phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API
- Not ratedosv:ECHO-a985-43d5-9a0cGHSA-r44j-crv5-q35m / NVD's own CPE match pins this to the single exact version percona-toolkit:3.6.0, with no version range -- the advisory is "unreviewed" and carries no upper bound, so CPE-based scanners (Trivy/Grype/Wiz) treat it as affecting every later version too. The vulnerable code (weak SHA-256-as-KDF password hashing in src/go/pt-secure-collect/encrypt.go) was replaced with a proper HKDF derivation upstream in commit 78f20304 ("Use KDF instead of hash"), first shipped in v3.7.0 and present in our v3.7.1 build. Independent of the version question, this package never builds pt-secure-collect at all -- only pt-online-schema-change (a separate Perl tool); the build step explicitly drops the manifypods->gotools coupling so Go tools are never compiled.
- Not ratedosv:CVE-2026-107639ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename
- Not ratedosv:CVE-2026-105397LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
- HighCVE-2026-102578Moodle: sql injection in question bank web service
- Not ratedosv:CVE-2026-102626LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
- Not ratedosv:CVE-2026-102578Moodle: sql injection in question bank web service
Other news entries
- Threat Modeling With 4 Simple Questions on a White BoardNewsDark Reading
- Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security PatchNewsThe Hacker News
- Nobody Trusts the Security Questionnaire. We Rely on It Anyway.NewsSecurityWeek
- Moving past autonomous exploitation to machine-speed securityNewsCSO Online
- Bullhorn sees red after cyberattack knocks recruitment platform offlineNewsThe Register — Security
- AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete PatchesNewsThe Hacker News
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCENewsThe Hacker News
- Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal AgenciesNewsThe Hacker News
ID