Arbitrary file manipulation vulnerability exists in the Brocade Fabric OS WebTools management

: An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file...

Command Injection in Security Certificate Management Subsystem

: An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution...

Local Privilege Escalation and Configuration Injection in Brocade Fabric OS System Logging Daemon

: A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication IPC channels allow an unprivileged local user to submit malformed logging...

Arbitrary File Read via Argument Injection in Configuration Search Utility

: An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search...

CVE-2026-86684: Incorrect Authorization

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

PT-2026-106712

A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The atta...

PT-2026-106708

Name of the Vulnerable Software and Affected Versions Craft CMS version 5.10.13.2 Description An authenticated remote code execution issue exists in the Control Panel action 'app/render-components'. Users with basic Control Panel access can submit request-controlled component classes and property...

PT-2026-106728

Name of the Vulnerable Software and Affected Versions Kusalkasilva Learning-Management-System versions up to ffeb873f8803f1e9664384ff75000c7da45466d2 Description A remote SQL injection exists within the Student Registration Endpoint component, specifically affecting an unknown function in the...

PT-2026-106317

A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...

PT-2026-106291

Name of the Vulnerable Software and Affected Versions girishsaraf Online-Appointment-Booking-System versions up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Description A remote SQL injection exists within the Booking Handler component in the book.php file. The issue occurs when the...

PT-2026-106319

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description A security flaw allows remote attackers to perform cross site scripting XSS, a technique where malicious scripts are injected into trusted websites, via an unknown function with...

PT-2026-106318

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and mig...

PT-2026-106390

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Student Information System version 1.0 Description Cross site scripting can occur via remote execution when the searchbox argument is manipulated. This issue affects the clean function within the searchresults.php file...

PT-2026-106387

Unauthenticated Privilege Escalation in Salon booking system = 10.31.7 versions...

PT-2026-106391

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

PT-2026-106357

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Memory corruption occurs during the execution of system service routines. This issue is caused by the improper handling of user input buffers, which can lead to...

PT-2026-106363

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely...

PT-2026-107289

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The push mirror API incorrectly validates permissions by checking if the repository owner, rather than the requesting user, is authorized to use local file system paths. On instances where the...

CVE-2026-105919: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysqlquery of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password result...

PT-2026-106307

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...