27026 matches found
CVE-2026-5018
A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.php of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack can be launched remotely. The explo...
CVE-2026-33280
Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands...
SUSE CVE-2026-32254
Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIPs or loadBalancer IPs before programming them into the node's network configuration. Version 2.8.0 contains a patch for the issue. Available workarounds...
PT-2026-28732
Name of the Vulnerable Software and Affected Versions Simple Food Order System version 1.0 Description A flaw exists in Simple Food Order System 1.0 related to the handling of parameters. Specifically, manipulating the Name argument can lead to SQL injection. This issue affects an unknown functio...
Code-Projects Simple Food Order System SQL注入漏洞
Code-Projects Simple Food Order System is a simple food ordering system developed by Code-Projects as open source. Version 1.0 of the Code-Projects Simple Food Order System has a SQL injection vulnerability. This vulnerability stems from improper handling of parameters by the unknown function in...
PT-2026-28752
Name of the Vulnerable Software and Affected Versions Belkin F9K1122 version 1.00.33 Description A security issue has been identified in Belkin F9K1122 version 1.00.33. The formSetSystemSettings function within the Setting Handler component, located in the /goform/formSetSystemSettings file, is...
CVE-2026-32695
A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When using the Knative provider, Traefik incorrectly interpolates user-controlled values into router rule expressions without proper escaping. This vulnerability allows an attacker to inject malicious rule syntax, leading to a...
07-calito-router (>=0.0.2, <=0.0.4), 07-dey-router (>=0.0.1, <=0.0.2) +952 more potentially affected by CVE-2026-4923 via path-to-regexp (>=8.0.0, <=8.3.0)
path-to-regexp NPM version =8.0.0, =0.0.2, =0.0.1, =0.0.0, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.2, =0.0.1-alpha.2, =0.0.1-alpha.1, =4.0.61, =4.0.61, =0.0.1, =0.3.1, =0.3.4 and more Source cves: CVE-2026-4923 Source advisory: GHSA-27V5-C462-WPQ7...
EUVD-2026-16809
A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack...
elevendoc (>=0.1.3, <=1.2.4), llm-adaptive-router (>=0.1.0, <=0.1.12) potentially affected by CVE-2026-34070 via langchain-core (0.3.8)
langchain-core PYPI version 0.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - elevendoc =0.1.3, =0.1.0, =0.1.12 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...
CVE-2026-4961
A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack is possible ...
CVE-2026-4961
CVE-2026-4961 affects the Tenda AC6 firmware version 15.03.05.16. The vulnerability is in the POST Request Handler’s file /goform/QuickIndex, specifically the formQuickIndex function. Manipulating the PPPOEPassword argument triggers a stack-based buffer overflow, enabling remote exploitation. Pub...
EUVD-2026-16640
A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 2026-01-19 in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podcastrouter.py, in function streamaudio. The stream-aud...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the Kubernetes Ingress and Knative provider buildRule/buildHostRule processes in the pkg/provider/kubernetes/ingress and pkg/provider/kubernetes/knative components. An attacker can bypass...
Improper Encoding or Escaping of Output
Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the Kubernetes Ingress and Knative provider buildRule/buildHostRule processes in the pkg/provider/kubernetes/ingress and pkg/provider/kubernetes/knative components. An attacker can bypass...
CVE-2026-5025 Langflow - Application Logs Exposed to All Authenticated Users
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication 'getcurrentactiveuser' without any privilege checks e.g., 'issuperuser'...
EUVD-2026-16545
Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed on the products...
CVE-2026-33280
CVE-2026-33280 affects BUFFALO Wi-Fi router products. Multiple sources confirm a hidden functionality issue that may allow an attacker to access the product’s debugging features, enabling execution of arbitrary OS commands. Reported by Red Hat, JVN, NVD, and others; impact is described as remote ...
