EUVD-2026-53020

A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

UBUNTU-CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

Malicious code in streak-map-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3 The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base64-encoded fragments into a...

MAL-2026-12001 Malicious code in streak-metricazbd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x8664 ELF dist/math-core.bin to /tmp/sm-engine-runtime/math-core.bi...

Malicious code in streak-metricazbd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x8664 ELF dist/math-core.bin to /tmp/sm-engine-runtime/math-core.bi...

Malicious code in streak-math-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...

PT-2026-72111

Name of the Vulnerable Software and Affected Versions PAX Technology Q80 affected versions not specified Description The XCB daemon lacks authentication, allowing network-adjacent attackers to disclose sensitive information and modify configurations. This flaw can be combined with other issues to...

PT-2026-68135

Name of the Vulnerable Software and Affected Versions IoTSharp affected versions not specified Description The BlobStorageController.cs component lacks the Authorize attribute and does not have a global authorization FallbackPolicy configured in Startup.cs. This allows unauthenticated remote...

CVE-2026-71262: Missing Authentication for Critical Function

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

PT-2026-67941

Name of the Vulnerable Software and Affected Versions H3C NX15 version V100R017 Description A flaw in the Web API component allows remote attackers to access a dangerous routine. This occurs through the service.add function within the '/api/esps' endpoint. Recommendations At the moment, there is ...

The vulnerability of the OATHAuth extension of the software for implementing the MediaWiki hypertext environment allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the OATHAuth extension for implementing the MediaWiki hypertext environment is related to insufficient protection of service data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the software for implementing the hypertext environment MediaWiki, related to insufficient protection of operational data, allows a violator to gain unauthorized access to protected information.

The vulnerability of the software for implementing the hypertext environment MediaWiki is related to insufficient protection of operational data. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the endpoint AssumeRoleWithLDAPIdentity of the STS (Security Token Service) server for MinIO object storage allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the endpoint of the STS Security Token Service, which manages MinIO object storage, is related to inconsistencies in response to incoming requests. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Repo.clone_from() function in the Python library for interacting with Git repositories in GitPython allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2025-63823

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

openjdk: Enhance JPEG handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. ASAN reports a heap integrity violation...

CVE-2026-18818 Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization

A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The...

MAL-2026-11541 Malicious code in nagixjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 213429bfb5c1c93becdd4c0236cd167a277114e88f47cff28799c20c6d1e72dd package.json declares postinstall: node test.js, which loads index.js and auto-runs on npm install. The code recursively scans the user's home...