CVE-2026-90840

PHPGurukul Blood Donor Management System 1.0 is affected by an improper authentication vulnerability in the __construct function of /application/controllers/admin/Dashboard.php (Admin Controllers component). The flaw can be exploited remotely with no privileges required and no user interaction , ...

CVE-2026-90829

GNU Binutils 2.47 is affected by a null pointer dereference in the function bfd_elf_set_group_contents within the file bfd/elf.c , part of the SHT_GROUP Section Handler component. The flaw is triggered by local manipulation and results in low impact on confidentiality, integrity, and availability...

CVE-2026-90621

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-90573

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfsgmfurldel of the file scenegraph/vrmltools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly...

EUVD-2026-77021

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

CVE-2026-90517

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-90507

CVE-2026-90507 affects the vvbbnn00 WARP-Clash-API (up to commit c7bf236), specifically the get_surge_subscription function in services/subscription.py (Subscription Handler component). Improper manipulation of the key argument leads to improper access control , exploitable remotely without authe...

EUVD-2026-76933

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

PT-2026-90860

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The affected element is an unknown function of the file travel/src/main/java/com/controller/UsersController.java of the component User Register Endpoint. Such manipulation of...

CVE-2026-86675 itsourcecode Sales and Inventory System us_edit.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/usedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2026-86665

A missing authorization vulnerability in aircheng-org iWebShop-5 (versions up to 5.15 ) affects the Update::index function in controllers/update.php. Unauthenticated remote attackers can manipulate this endpoint, resulting in low impact to confidentiality, integrity, and availability (CVSS 3.1 ba...

CVE-2026-86665 aircheng-org iWebShop-5 update.php index authorization

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be...

CVE-2026-86514

A weakness has been identified in vgmstream up to r2117. This issue affects the function sscanf of the file src/meta/txth.c of the component txth-txtp. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to t...

CVE-2026-86512

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

EUVD-2026-72613

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

CVE-2026-86282

A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Executing a manipulation of the argument...

CVE-2026-86239

A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is...

CVE-2026-86225 SourceCodester Class and Exam Timetabling System modal_add_room.php mysqli_query sql injection

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqliquery of the file /admin/modaladdroom.php. The manipulation of the argument roomname leads to sql injection. The attack is possible to be carried out...

EUVD-2026-70889

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The...

CVE-2026-85110

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly...