EUVD-2026-64045

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

CVE-2026-18295

A flaw was found in GStreamer. This out-of-bounds write vulnerability occurs during the parsing of MRF files due to improper validation of user-supplied data. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file. Successful exploitatio...

CVE-2026-76888

A flaw was found in Wireshark. A remote attacker could exploit a heap-based buffer overflow vulnerability within the RDP Remote Desktop Protocol dissector. By crafting a malicious RDP packet, an attacker could cause the Wireshark application to crash, leading to a denial of service. Mitigation Do...

CVE-2026-76887

A flaw was found in Wireshark. This heap-based buffer overflow vulnerability in the dissection engine could allow a remote attacker to cause a denial of service. Exploitation requires a user to process a specially crafted network packet, leading to a crash of the application. Mitigation Do not op...

CVE-2026-76882

A flaw was found in Wireshark. The Bluetooth Attribute Protocol dissector contains an out-of-bounds read vulnerability. A remote attacker could exploit this by crafting a malicious Bluetooth packet, leading to a crash of the Wireshark application. This crash results in a denial of service DoS,...

CVE-2026-77686

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to...

CVE-2026-77683

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntptimezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit ha...

EUVD-2026-63897

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to...

CVE-2026-77686 Dolibarr Account card.php improper authorization

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to...

CVE-2026-77686 Dolibarr Account card.php improper authorization

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php of the component Account Handler. This manipulation of the argument ID causes improper authorization. The attack may be initiated remotely. The exploit has been made available to...

CVE-2026-77681

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-77683

Comfast CF-N1-S firmware 2.6.0.1 is affected by a command injection vulnerability in the system function of the CGI endpoint /cgi-bin/mbox-config?method=SET&section=ntp_timezone. Manipulation of the timestr argument allows an authenticated remote attacker to inject and execute arbitrary system co...

EUVD-2026-63884

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntptimezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-77683 Comfast CF-N1-S mbox-config system command injection

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntptimezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit ha...

EUVD-2026-63876

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-77681

CodeAstro Online Job Portal 1.0 is affected by an unrestricted file upload vulnerability in the file /users/update-profile.php. Manipulation of the Name argument allows a remote, authenticated attacker (low privileges) to upload arbitrary files, leading to low impact on confidentiality, integrity...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 (CVE-2025-53066, CVE-2025-53057)

Summary IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 is vulnerable to a Exposure of Sensitive Information, Improper Access Control attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-53066 DESCRIPTION: An unspecified vulnerability in Java SE...

CVE-2026-76158

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-77392

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-77391

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...