EUVD-2026-19495

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA Web gerenciador para instituições assistenciais contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The idmemorando parameter is extracted from $REQUEST without validation and directly interpolated into...

GHSA-9CQF-439C-J96R

creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8...

GHSA-JG96-P5P6-Q3CV

creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8...

GHSA-RP9M-7R4C-75QG

creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:09+00:00| seen| Telegram/t1F-Vxaulmn07lvg5ppSTSOssGvqtwkUpkkBVUVRjFPlk...

GHSA-QCMW-8MM4-4P28

creationtimestamp| type| source ---|---|--- 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM...

GHSA-P5RH-VMHP-GVCW

creationtimestamp| type| source ---|---|--- 2026-04-06 19:28:28+00:00| published-proof-of-concept| Telegram/nNz4AuVWmZsX2vjW9IzWDm0wIi6EKHH8QFJ1lll9JUSWJdI 2026-04-07 02:48:17+00:00| seen| https://bsky.app/profile/cyber-news-fi.bsky.social/post/3miurceg26g22...

CVE-2026-5681 itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection

A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument empid causes sql injection. The attack is possible to be carried out remotely. The explo...

CVE-2026-5681 itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection

A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument empid causes sql injection. The attack is possible to be carried out remotely. The explo...

CVE-2026-35458

creationtimestamp| type| source ---|---|--- 2026-04-06 19:06:54+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-fmwg-qcqh-m992 2026-04-07 17:29:08+00:00| seen| Telegram/S0o7tCbZtDmnRvZjM5kXvvB9yXwoblxnXV5GlrmaLffoEZI...

CVE-2026-35179 WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access...

CVE-2026-5659

A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.setstate of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been mad...

CVE-2025-48651

In importWrappedKey of KMKeymasterApplet.java, there is a possible way access keys that should be restricted due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-5672

A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument catid leads to sql injection. It is possible to initiate the...

GHSA-36XV-JGW5-4Q75 @nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Impact What kind of vulnerability is it? Who is impacted? SseStream.transform interpolates message.type and message.id directly into Server-Sent Events text protocol output without sanitizing newline characters \r, \n. Since the SSE protocol treats both \r and \n as field delimiters and \n\n as...

CVE-2026-5672 code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection

A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument catid leads to sql injection. It is possible to initiate the...

GHSA-8H6P-M6GR-MPW9

creationtimestamp| type| source ---|---|--- 2026-04-06 17:32:59+00:00| seen| Telegram/Nu9QDXzNbve1iNgaEifpWzTHqsZ9MAX7l9lhuN92ZYucbK4...

CVE-2026-22561

creationtimestamp| type| source ---|---|--- 2026-04-06 17:30:24+00:00| published-proof-of-concept| Telegram/i2wIvqy39CRBnxM6Nflxvy-bZIfB5xec6SNNV804lQCNEY...

CVE-2026-5663

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible...

CVE-2026-5663

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible...

CVE-2026-34934

PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the getalluserthreads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via updatethread. When the application loads the thread list, t...