CVE-2026-86215: Insufficient Session Expiration

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation of the argument logout leads to session expiration. It is possible to launch the attack remotely. T...

CVE-2026-86179: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/expak.sql of the component Database Backup Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The...

PT-2026-86489

A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Expense-Manager/exp ak.sql of the component Database Backup Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. The...

CVE-2026-86213: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqliquery of the file Front-end/university.php of the component Search Handler. The manipulation of the argument bookname/bookauthor results in sql injection. The attack may be performed from remote...

PT-2026-86527

A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli query of the file Front-end/university.php of the component Search Handler. The manipulation of the argument book name/book author results in sql injection. The attack may be performed from...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053294)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053294 advisory. In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler The TX buffer in spitransfer can be...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053143)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053143 advisory. A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6streamops/inet6dgramops of the component...

OESA-2026-3684 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference...

OESA-2026-3683 busybox security update

The Swiss Army Knife of Embedded Linux Security Fixes: A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference...

CVE-2026-86173

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-86117

Coolify (through version 4.3.17 ) is affected by an authentication bypass in its OAuth callback handler. The root cause is that the handler signs users into existing accounts based solely on email address matching , without verifying provider assertions or binding OAuth identities. An attacker ca...

CVE-2026-86117 Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

CVE-2026-86117 Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

CVE-2026-86117

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any...

CVE-2026-75586

Unlimited Elements For Elementor (WordPress plugin) is affected by a Reflected Cross-Site Scripting vulnerability in the formData[id] parameter across all versions up to and including 2.0.17 . The root cause is a front-end AJAX handler registered on the public wp action with no nonce, capability,...

CVE-2026-16649

Gravity Forms for WordPress (all versions up to and including 2.10.5 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the Post Body Field Value. The root cause is insufficient input sanitization and output escaping: wp_kses_post permits the required HTML tags and attributes, whi...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82304

The Music Store WordPress plugin (versions before 1.4.5 ) is vulnerable to an unauthenticated SQL injection (SQLi). The root cause is the failure to sanitise and escape user input before its inclusion in a SQL statement. Specifically, the vulnerability exists within the paypal-data handler. An un...

CVE-2026-81423

The Accept Stripe Payments WordPress plugin (versions before 2.1.4 ) contains an Open Redirect vulnerability. The root cause is a failure to validate a user-supplied URL before utilizing it in a redirect, specifically through the IPN Handler . This allows unauthenticated attackers to redirect web...