CVE-2025-69941

SourceCodester Tailor Management System version 1.0 is vulnerable to SQL Injection via the id parameter in the addmeasurement.php endpoint. This vulnerability allows for the execution of malicious SQL statements, potentially impacting the confidentiality, integrity, and availability of the databa...

CVE-2025-69941

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1...

PT-2026-66630

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A crafted IEC 60870-5-104 I-frame with TypeID 104 C TS NA 1 and an inflated object count causes the TestCommand getFromBuffer function to read one byte past the...

CVE-2025-69931

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembership.php?id=1...

PT-2026-66461

Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw exists in the CostManagementMetricsConfig custom resource. A user with permissions to edit this resource can specify an arbitrary OAuth token endpoint. If the...

GHSA-XVG2-CGV6-6H7V

creationtimestamp| type| source ---|---|--- 2026-07-29 22:32:10+00:00| seen| https://gist.github.com/alon710/4f3175144e6d12e46b24b49c3b567546 2026-07-30 00:01:11+00:00| seen| https://gist.github.com/alon710/4f3175144e6d12e46b24b49c3b567546...

CVE-2025-69949

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in checkavailability.php via the parameters emailid and email...

CVE-2025-67406

https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code remote. The component is: control/activatecase.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activatecase.php in parameter id...

CVE-2025-69943

kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in getdoctor.php via the parameters doctor and specilizationid...

CVE-2026-67435

creationtimestamp| type| source ---|---|--- 2026-07-29 21:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrstx5hkw522 2026-07-31 01:31:12+00:00| seen| https://gist.github.com/alon710/d1939c63ece21d1bd9e89d2add282b5b...

CVE-2026-67436

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...

CVE-2026-5487

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service,...

CVE-2026-67436 Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...

CVE-2026-67436

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...

CVE-2026-67436

CVE-2026-67436 affects Linuxfabrik monitoring-plugins (6.0.0 and earlier), specifically the redfish-* plugins. The root cause is that these plugins build request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, enabling a malicious or compromised BMC to ...

MINI-6MRQ-CRM8-MPCH

Bulletin has no description...

CVE-2026-67431

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that...

CVE-2026-64268

A flaw was found in the Linux kernel's Soft iWARP siw driver. A remote attacker, by sending specially crafted Read Response segments that exceed the requested length, can trigger an out-of-bounds write. This vulnerability can lead to memory corruption, potentially causing a kernel crash or...

CVE-2026-54693

creationtimestamp| type| source ---|---|--- 2026-07-29 17:31:36+00:00| seen| https://gist.github.com/alon710/122d827ca97ab8457c12647e94a1482c 2026-07-29 18:18:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsjxpyzb222...

GHSA-W8XC-8G92-V77H Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

Summary Easy!Appointments correctly filters provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and appointments/update only check generic appointment privileg...