The vulnerability of the max77705_charger_probe() function in the drivers/power/supply/max77705_charger.c file of the Linux kernel’s power management driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the max77705chargerprobe function in the drivers/power/supply/max77705charger.c file of the Linux kernel’s power management driver relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the reg() function in the lib/grammar.js module, a module for defining methods to access and manage XML documents, allows attackers to bypass existing security mechanisms.

The vulnerability of the reg function in the lib/grammar.js module, which is used for accessing and managing XML documents, is related to errors in processing XML requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

CVE-2026-85454

MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the...

CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...

CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...

CVE-2026-85378

light0011 cms contains an authorization bypass in the Chapter Controller component, specifically in the function AuthController::_initialize within the file App/Admin/Controller/ChapterController.class.php . The flaw allows a remote, unauthenticated attacker to bypass access controls with low com...

CVE-2026-85444

MOOS-IvP through version 24.8.1 contains a buffer over-read vulnerability in the isQuoted(), isBraced(), and isChevroned() functions within MBUtils.cpp. These functions strip whitespace from input but then index using the original string length , causing reads past buffer bounds. An attacker can ...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the deepRef function of lib/compiler.js, which traverses through a scalar value into the prototype chain, and whose containment guard is missed because currentPath inconsistently holds arrays that coerce to...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the deepRef function of lib/compiler.js, which traverses through a scalar value into the prototype chain, and whose containment guard is missed because currentPath inconsistently holds arrays that coerce to...

CVE-2026-85208 itsourcecode Online Medicine Delivery System Order Management Controller controller.php doInsert unrestricted upload

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

CVE-2026-85208

itsourcecode Online Medicine Delivery System 1.0 is affected by an unrestricted file upload vulnerability in the Order Management Controller , specifically the doInsert function within /rider/orders/controller.php?action=add. Manipulating the image argument allows an unauthenticated remote attack...

CVE-2026-85205

A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controller.php?action=addwish of the component Wishlist. This manipulation of the argument proid causes sql injection. The attack may be initiated...

CVE-2026-85138 SeaCMS WeChat index.php addslashes sql injection

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

EUVD-2026-70522

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the...

CVE-2026-85137 SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

CVE-2026-85137 SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

CVE-2026-85137

SeaCMS up to 13.6 is affected by a code injection vulnerability in the parseIf function within the file seacms_locoy_news.php, part of the Locoy Collector component. The flaw is triggered by manipulating the pwd argument, allowing remote attackers to inject and execute arbitrary code without auth...

qs: qs: Denial of Service via improper validation in stringify function

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

CVE-2026-85172

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

CVE-2026-85040

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...