CVE-2026-100657

The Netty STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in the StompSubframeDecoder component. The vulnerability occurs because the decoder allocates a chunk buffer after reading a frame's content length but waits for a terminating NUL byte . If this byte is withheld, the buffe...

EUVD-2026-87751

Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that...

CVE-2026-100657 Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder

Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that...

CVE-2026-100644

Versions of SiYuan prior to v3.8.4 are vulnerable to a SQL injection vulnerability within the graph query endpoint . The root cause is the improper concatenation of the dailyNoteSavePath parameter into SQL queries without sufficient escaping. This flaw allows unauthenticated attackers targeting p...

CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

EUVD-2026-87725

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631 Parse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection

Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database querie...

CVE-2026-100631

The open-source backend server Parse Server is vulnerable to an unauthenticated remote attack in versions prior to 8.6.90 and from 9.0.0 prior to 9.10.1-alpha.9 . The root cause is a failure to validate the type of client-supplied installation fields within the device token deduplication logic be...

CVE-2026-100600

The ClawHub (openclaw/clawhub application/backend) application is vulnerable to quota exhaustion because anonymous HTTP API requests are not bound to a trusted caller identity. This allows a remote, unauthenticated caller to drain a shared default quota, potentially denying or degrading API acces...

CVE-2026-100315

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

In Google Chrome on Linux, before version 150.0.7871.125, using free after UI interactions allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

An observable discrepancy in forms in Google Chrome prior to version 152.0.7977.65 allowed a remote attacker to obtain sensitive information through a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-87694

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

CVE-2026-100315 mathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

CVE-2026-100315

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw is located within an unknown function of the mydetailsfaculty.php file, where improper handling of the myfid argument allows for remote exploitatio...

CVE-2026-100314

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated...

CVE-2026-100313

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. Executing a manipulation of the argument queryx can lead to cross site scripting. It is possible to launch the...