CVE-2026-34874

An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0...

Himmelblau 安全漏洞

Himmelblau is an open-source Azure Entra ID authentication module developed by Himmelblau. There is a security vulnerability in Himmelblau, which stems from conditional local privilege escalation due to name conflicts in edge scenarios. If the mapped CN or short name matches the name of a...

The vulnerability of the redirect.asp file in the goahead component of D-Link DIR-816 router software allows a hacker to access the redirect.asp page and extract the token_id.

The vulnerability of the redirect.asp file of the goahead component in D-Link DIR-816 router microprogramming software is related to deficiencies in access control and improper assignment of privileges. Exploiting this vulnerability allows an attacker to gain access to the redirect.asp page and...

CVE-2026-5238 itsourcecode Payroll Management System Parameter view_employee.php sql injection

A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /viewemployee.php of the component Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed...

CVE-2026-5238

A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /viewemployee.php of the component Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed...

CVE-2026-5238

Affects itsourcecode Payroll Management System 1.0. The vulnerability exists in the Parameter Handler’s view_employee.php, where manipulating the ID parameter leads to SQL injection. This is a remote exploit with public proof-of-concept; CVSS metrics indicate high impact (network access, no authe...

GHSA-68P4-J234-43MV

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:56+00:00| seen| Telegram/8TNuFRjRJBw5r6zwiOXWdT-cqnzTtiBnsbsFB7NS1OTWS8...

GHSA-GV25-WP4H-9C35

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:56+00:00| seen| Telegram/8TNuFRjRJBw5r6zwiOXWdT-cqnzTtiBnsbsFB7NS1OTWS8...

GHSA-RX4H-526Q-4458

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:56+00:00| seen| Telegram/8TNuFRjRJBw5r6zwiOXWdT-cqnzTtiBnsbsFB7NS1OTWS8...

CVE-2026-5237 itsourcecode Payroll Management System Parameter manage_user.php sql injection

A security flaw has been discovered in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /manageuser.php of the component Parameter Handler. Performing a manipulation of the argument ID results in sql injection. The attack is possib...

CVE-2026-5236 Axiomatic Bento4 DSI v1 Ap4Dac4Atom.cpp SkipBits heap-based overflow

A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument npresentations leads to heap-based buffer overflow. The attack needs to be performed...

CVE-2026-31946

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. From version 10.5.4 to before version 20.2.5, OpenOLAT's OpenID Connect implicit flow implementation does not verify JWT signatures. The JSONWebToken.parse method silently discards the...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG seeded with predictable values in the secretkey and hashidsalt. An attacker can gain unauthorized access to any user account, including administrators, by brute-forcing t...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG seeded with predictable values in the secretkey and hashidsalt. An attacker can gain unauthorized access to any user account, including administrators, by brute-forcing t...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG seeded with predictable values in the secretkey and hashidsalt. An attacker can gain unauthorized access to any user account, including administrators, by brute-forcing t...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG seeded with predictable values in the secretkey and hashidsalt. An attacker can gain unauthorized access to any user account, including administrators, by brute-forcing t...

Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)

Impact This vulnerability affects Cloudreve instances that were first deployed/initialized with versions prior to V4.10.0. The application uses the weak pseudo-random number generator math/rand seeded with time.Now.UnixNano to generate critical security secrets, including the secretkey, and...

CVE-2026-34504

creationtimestamp| type| source ---|---|--- 2026-03-31 19:20:10+00:00| seen| Telegram/kcbrs7WWw-nIPeTyrZTDg68aatJd3a7QKUME-vVoB020PA 2026-03-31 19:20:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mievhsgcv722 2026-04-01 06:26:34+00:00| seen|...

EUVD-2026-17581

A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file specifically the saveloan action. The application fails to properly sanitize user input supplied to the "borrowerid" parameter in a POST request, allowing an...

EUVD-2026-17510

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data...