CVE-2026-2010 Sanluan PublicCMS Trade Payment TradePaymentService.java paid improper authorization

A vulnerability has been found in Sanluan PublicCMS up to 4.0.202506.d/5.202506.d/6.202506.d. Impacted is the function Paid of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java of the component Trade Payment Handler. The manipulatio...

davids-xss-attack-defense

XSS Attack & Defense EXPERIMENT 1: Stored XSS Attack aler...

davids-xss-lab

XSS Attack & Defense EXPERIMENT 1: Stored XSS Attack aler...

CVE-2026-2009 SourceCodester Gas Agency Management System createUser.php access control

A flaw has been found in SourceCodester Gas Agency Management System 1.0. This issue affects some unknown processing of the file /gasmark/phpaction/createUser.php. Executing a manipulation can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-2000

A vulnerability was found in DCN DCME-320 up to 20260121. Impacted is the function applyconfig of the file /function/system/basic/bridgecfg.php of the component Web Management Backend. Performing a manipulation of the argument iplist results in command injection. The attack is possible to be...

CVE-2026-2000

A vulnerability was found in DCN DCME-320 up to 20260121. Impacted is the function applyconfig of the file /function/system/basic/bridgecfg.php of the component Web Management Backend. Performing a manipulation of the argument iplist results in command injection. The attack is possible to be...

EUVD-2026-5677

A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a conversation identifier belongs to the authenticated user making the request. As a result, an attacker with valid credentials could acces...

CVE-2026-0598

A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a conversation identifier belongs to the authenticated user making the request. As a result, an attacker with valid credentials could acces...

CVE-2026-0598 Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api

A security flaw was identified in the Ansible Lightspeed API conversation endpoints that handle AI chat interactions. The APIs do not properly verify whether a conversation identifier belongs to the authenticated user making the request. As a result, an attacker with valid credentials could acces...

CVE-2026-1978

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The...

EUVD-2026-5600

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The...

CVE-2026-1978

A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The...

CVE-2026-1895

A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to addre...

The vulnerability of the drm_gem_dma_free() function in the drivers/gpu/drm/drm_gem_dma_helper.c module of the Direct Rendering Infrastructure (DRI) driver in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drmgemdmafree function in the drivers/gpu/drm/drmgemdmahelper.c module of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-6688

Name of the Vulnerable Software and Affected Versions Sanluan PublicCMS versions 4.0.202506.d through 6.202506.d Description A security issue exists in Sanluan PublicCMS related to improper authorization. The Paid function within the TradePaymentService.java file, located at...

PT-2026-6672

Name of the Vulnerable Software and Affected Versions kalyan02 NanoCMS versions up to 0.4 Description A flaw exists in kalyan02 NanoCMS that allows for remote request manipulation. The issue is related to an unknown functionality within the /data/pagesdata.txt file of the User Information Handler...

The vulnerability of the gdlm_put_lock() function in the fs/gfs2/lock_dlm.c file of the GFS2 file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the gdlmputlock function in the fs/gfs2/lockdlm.c file of the GFS2 file system in the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

The vulnerability of the __drm_gem_fb_end_cpu_access() function in the drivers/gpu/drm/drm_gem_framebuffer_helper.c module of the Direct Rendering Infrastructure (DRI) driver of the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the drmgemfbendcpuaccess function in the drivers/gpu/drm/drmgemframebufferhelper.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service...

The vulnerability of the `dc_stream_get_scanoutpos()` function in the drivers/gpu/drm/amd/display/dc/core/dc_stream.c file of the Direct Rendering Infrastructure (DRI) driver for AMD graphics cards in Linux operating systems allows a malicious actor to cause a service failure.

The vulnerability of the dcstreamgetscanoutpos function in the drivers/gpu/drm/amd/display/dc/core/dcstream.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability could allow a...

The vulnerability of the bcsp_recv() function in the drivers/bluetooth/hci_bcsp.c module of the Linux Bluetooth device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the bcsprecv function in the drivers/bluetooth/hcibcsp.c module of the Linux Bluetooth device driver framework is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...