CVE-2026-90802

A weakness has been identified in GNU Binutils 2.47. Affected is the function bfdputl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been made available to the public and could be used for attack...

CVE-2026-90801

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cachebwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and ma...

CVE-2026-90796

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-90794

A vulnerability was found in GPAC up to f1219cde. The affected element is the function gfsgscriptload of the file scenegraph/vrmltools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public a...

CVE-2026-90801 GNU Binutils ld cache.c cache_bwrite buffer overflow

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cachebwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack requires a local approach. The exploit has been released to the public and ma...

CVE-2026-54452 safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

CVE-2026-54452 safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6true, an attacker-controlled destination in one of these...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters

A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during...

CVE-2026-90796 itsourcecode Leave Management System index.php sql injection

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-90796

itsourcecode Leave Management System 1.0 contains a SQL injection vulnerability in the file /module/company/index.php , triggered by manipulating the ID argument. The attack is remotely exploitable and requires low privileges with no user interaction. Impact is rated MEDIUM (CVSS 3.1 score 6.3), ...

EUVD-2026-77616

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

EUVD-2026-77575

A vulnerability was found in GPAC up to f1219cde. The affected element is the function gfsgscriptload of the file scenegraph/vrmltools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public a...

CVE-2026-90789

A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument useremail can lead to sql injection. The attack may be launched remotely. The exploit has been made...

Exploits + Shellcode + GHDB v2026-09-12

The Exploit Database Git Repository This is an official repository of The Exploit Database, a project sponsored by Offensive Security. Our repositories are: Exploits & Shellcodes: gitlab.com/exploit-database/exploitdb Binary Exploits: gitlab.com/exploit-database/exploitdb-bin-sploits Papers:...

EUVD-2026-77538

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-90791 GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-90787

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper...

EUVD-2026-77526

A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument useremail can lead to sql injection. The attack may be launched remotely. The exploit has been made...

CVE-2026-90788 magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...

EUVD-2026-77489

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...