PT-2026-90802

Name of the Vulnerable Software and Affected Versions lenve vhr version 1.0-SNAPSHOT Description Remote manipulation of the Password argument within the HrInfoController.updateHr function of the HrMapper.xml file leads to improper privilege management. Recommendations As a temporary workaround,...

PT-2026-90859

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be...

PT-2026-90779

Name of the Vulnerable Software and Affected Versions webgjc web robot version 2.4.0 webgjc web robot version 2.5.0 webgjc web robot version 2.8.0 Description Remote os command injection is possible through the manipulation of the case name argument. This issue occurs within the controller listen...

PT-2026-90854

Name of the Vulnerable Software and Affected Versions jaychouchannel Tourism-Management-System versions up to 84d8ec384f669df3985293dab293bb7b477efa64 Description Improper authorization exists within the Authorization Interceptor component, specifically affecting the AuthorizationInterceptor.java...

PT-2026-90789

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description A remote cross site scripting issue exists in the Task Title Output component. The problem occurs within the getTitle function located in the application/views/task/add task.php...

PT-2026-90842

A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save stud.php. Such manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

PT-2026-90822

Name of the Vulnerable Software and Affected Versions vvbbnn00 WARP-Clash-API versions up to c7bf2360073959861219b422e51ae86411051b46 Description A race condition exists within an unknown function of the Save Account Job component. This issue allows a remote attacker to initiate an attack, althou...

CVE-2026-90488 Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

PT-2026-90781

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description A race condition occurs due to improper synchronization when using a shared resource. This allows an authorized attacker to elevate privileges locally on the system...

exploitcode

Exploit Code Lab-validated proof-of-concept code for publicly...

EUVD-2026-75213

A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoicebill.php of the component Invoice Generation. Such manipulation of the argument orderdate/invoiceno leads to...

CVE-2026-69689

creationtimestamp| type| source ---|---|--- 2026-09-08 22:09:11+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:08:05+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:45:03+00:00|...

CVE-2026-69421

creationtimestamp| type| source ---|---|--- 2026-09-08 22:06:47+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 04:06:04+00:00| seen| https://www.thezdi.com/blog/2026/9/8/the-september-2026-security-update-review 2026-09-09 09:17:42+00:00|...

EUVD-2026-74057

A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vaultunlockhandler/vaultrecoveryhandler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-86808 moltis-org moltis vault.rs vault_recovery_handler missing authentication

A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vaultunlockhandler/vaultrecoveryhandler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-86716 Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow

A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skipspacesandcomments of the file src/mjstok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The...

CVE-2026-86716 Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow

A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skipspacesandcomments of the file src/mjstok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The...

CVE-2026-86673 ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...

CVE-2026-86673 ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...

EUVD-2026-74045

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The...