WordPress Schema & Structured Data for WP & AMP plugin 1.63-1.65 - Contributor+ Non-Public Post Content Disclosure vulnerability

Contributor+ Non-Public Post Content Disclosure vulnerability discovered by Shirshak in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.63-1.65...

CVE-2026-92221

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

PT-2026-93261

Name of the Vulnerable Software and Affected Versions gedelumbung HospitalManagement versions up to c2d45543789a3887067d3915f69d44cfc2cf76a8 Description A remote SQL injection is possible through the manipulation of the cari argument within the generate index pasien function located in the...

Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

Overview A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for remediation. Successful exploitation results in arbitrary code execution within the coding‑agent environment and access to connected source repositories. This...

CVE-2026-87169

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite component: Wage Determination Online. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT...

EUVD-2026-79804

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite component: Award/PO. Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie RFC6265 §5.3 step 6 and no public suffix check. A malicious or compromised server can therefore...

EUVD-2026-78826

A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument desc leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2026-91848

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

EUVD-2026-78672

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. The attack can be executed remotely. Th...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...

EUVD-2026-78784

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-91848 WuzhiCMS index.php getDataOfJson sql injection

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-91848 WuzhiCMS index.php getDataOfJson sql injection

A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=article&v=getDataOfJson. The manipulation of the argument title/mastertable leads to sql injection. Remote exploitation of the attack is possibl...

CVE-2026-91835 OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/staticscanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is n...

grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memor...

CVE-2026-48717 OpenAM OAuth Authorization Bypass via PKCE Challenge

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, AuthorizationCodeGrantTypeHandler requires a codeverifier only when the realm-wide codeVerifierEnforced setting is enabled, even when an authorization code stores a codechallenge. Because that setting is disabled by...

CVE-2026-91091

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly...

CVE-2026-91089

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gfnodegetnameandid of the file scenegraph/basescenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version...

EUVD-2026-78318

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly...