161183 matches found
CVE-2026-114251
A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/custdel.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit h...
CVE-2026-91415
A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces APIs, such as through a web service or application that processes graphics data. A successful attack...
EUVD-2026-107322
Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have a message that the server's virus scanner found infected delivered to the recipient's mailbox unchanged. With virus scanning...
EUVD-2026-107321
Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write, naming in its From an address at a domain the server hosts, delivered to other receivers as passing that domain...
EUVD-2026-107316
Incorrect authorization in the Sender Rewriting Scheme SRS of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at...
CVE-2026-114463
The webhook platform gateway in Nous Research Hermes Agent is vulnerable to an authorization bypass. The gateway constructs the session chat_id using the format webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting this string. If a {route_name} contains a colon (:)...
CVE-2026-114463 CVE-2026-114463
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chatid as webhook:routename:deliveryid and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix rou...
EUVD-2026-107306
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chatid as webhook:routename:deliveryid and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix rou...
CVE-2026-114463 CVE-2026-114463
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chatid as webhook:routename:deliveryid and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix rou...
Vulnerabilities in Oracle Analytics
Oracle has identified 33 vulnerabilities in various Oracle Analytics products, including Oracle Business Intelligence Enterprise Edition and Oracle BI Publisher. The patch notes list these 33 vulnerabilities, among which 14 can be exploited remotely without the need for authentication. Depending ...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
CVE-2026-114249
The dhikshitha29 Insurance-Management-System contains an improper authorization vulnerability within the Policy Holder Update Form component, specifically affecting the file /Agent/includes/UpdatePolicyHolder-inc.php. By manipulating the Policy_no argument, an attacker can achieve unauthorized ac...
CVE-2026-114249 dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. Th...
EUVD-2026-107228
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internalport, the HTTP built-in service exemption on internalport can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on...
CVE-2026-78334
Missing authentication in the streaming RPC path of Apache bRPC version 1.18.0 on all platforms allows a remote attacker to bypass server authentication and inject or deliver streaming frames, when a server is configured with an Authenticator. Root Cause: When authentication is configured,...
CVE-2026-114243
A security flaw exists in the dhikshitha29 Insurance-Management-System within the mysqli_query function of the /Agent/ManagePolicy/EditPolicyHolder.php file. Remote attackers can perform an SQL injection by manipulating the Policy_no/Name arguments. While the project utilizes a rolling release st...
CVE-2026-114243 dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection
A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqliquery of the file /Agent/ManagePolicy/EditPolicyHolder.php. Performing a...
CVE-2011-1571
CVE-2011-1571 Summary Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition CE 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors. CVE Detail :...
EUVD-2026-107216
Enforceable assertion in the streaming feature of Apache bRPC version 0 and unconditionally asserts CHECKbuf.IsEmpty on the frame payload. A feedback frame that carries an unexpected payload, or a feedback frame received on a stream where flow control is disabled curbufsize == 0, reaches these...