CVE-2026-30532

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/viewproduct.php file via the "id" parameter...

OpenUI 代码注入漏洞

OpenUI is an open-source UI program developed byWeights & Biases. Versions of OpenUI 1.0 and earlier had a code injection vulnerability, which was caused by incorrect handling of parameter IDs, potentially leading to HTML injection...

PT-2026-28617

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description The plugin/Live/uploadPoster.php endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary live schedule id. The endpoint...

CVE-2026-30534: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/managecategory.php via the "id" parameter...

CVE-2026-30534

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/managecategory.php via the "id" parameter...

XAgent 安全漏洞

XAgent is an open-source, experimental large language model-driven autonomous agent developed by OpenBMB. Version 1.0.0 of XAgent contains a security vulnerability, which stems from incorrect handling of the parameter interactionid in the file XAgentServer/application/websockets/replayer.py,...

CVE-2026-30533: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manageproduct.php file via the "id" parameter...

CVE-2026-30533

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manageproduct.php file via the "id" parameter...

WeGIA SQL注入漏洞

WeGIA is a network manager for the welfare organization developed by Nilson Lazarin. Versions of WeGIA prior to 3.6.7 contained an SQL injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter idtag in the file html/socio/sistema/deletartag.php, which could lead...

CVE-2026-30534

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/managecategory.php via the "id" parameter...

CVE-2026-29070

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin,...

CVE-2026-32120

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Reference IDOR vulnerability in the fee sheet product save logic library/FeeSheet.class.php allows any authenticated user with fee sheet ACL...

CVE-2026-25002

creationtimestamp| type| source ---|---|--- 2026-03-26 21:34:32+00:00| seen| Telegram/jvhOKmzqiPeYBdBxVFESt3SUAdqySxNGUXLiFxkgoqjLWk...

GHSA-CPGW-WGF3-XC6V

creationtimestamp| type| source ---|---|--- 2026-03-26 21:03:16+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mhyivdkgzk2t...

AWS VDP: Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)

The Kiro IDE version 0.11.107 wrote authentication tokens access token and refresh token to a file with world-readable permissions 0644. The file contained sensitive information, including the access token, refresh token, and profile ARN. This exposed the credentials to potential unauthorized...

CVE-2026-33506

creationtimestamp| type| source ---|---|--- 2026-03-26 20:54:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyifeaw6m27 2026-03-26 21:20:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhyjugwtbq2r 2026-03-26 21:36:49+00:00| seen|...

GO-2026-4833 NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server

NATS is vulnerable to MQTT hijacking via Client ID in github.com/nats-io/nats-server...

OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

Summary Synology Chat reply delivery could rebind to a mutable username match instead of the stable numeric userid recorded by the webhook event. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

GHSA-WV46-V6XC-2QHF OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.

Summary Synology Chat reply delivery could rebind to a mutable username match instead of the stable numeric userid recorded by the webhook event. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

CVE-2026-4923

creationtimestamp| type| source ---|---|--- 2026-03-26 18:56:15+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mhybs4t2sk27 2026-03-26 20:17:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhygeac6dl2i...