Contao crawler leaks auth credentials to external hosts

Summary Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony...

CVE-2026-19068 itsourcecode Hospital Management System treatmentdetail.php sql injection

A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Executing a manipulation of the argument patientid can lead to sql injection. The attack can be executed remotely. The exploit has been made...

CVE-2026-19068

The CVE-2026-19068 entry concerns itsourcecode Hospital Management System 1.0. The vulnerability is an SQL injection in the /treatmentdetail.php file, triggered by manipulating the patientid argument. It is exploitable remotely, with a publicly available exploit and Proof-of-Concept code, indicat...

CVE-2026-54619

A flaw was found in sqlite3-ruby. When a SQLite function is redefined with a different number of arguments arity, the previously registered function handler is prematurely freed. This can lead to a use-after-free vulnerability, where the program attempts to access memory that has already been...

MAL-2026-13446 Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

Malicious code in express-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34482e23635422fb5ca5632e68708453f1c99317a31e5e8346c75c4d3466560f express-chai presents itself as an Express logger middleware impersonating pino, but its exported middleware factory invokes lib/caller.js which...

CVE-2026-19067

The CVE-2026-19067 entry concerns itsourcecode Hospital Management System 1.0. A SQL injection flaw is triggered in /treatment.php via the editid parameter, enabling remote exploitation. The exploit has been released publicly. No remediation details are provided in the supplied documents.

CVE-2026-19067 itsourcecode Hospital Management System treatment.php sql injection

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has bee...

CVE-2026-19066 SourceCodester Online Examination & Learning Management System view_students.php authorization

A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file viewstudents.php. Such manipulation of the argument classgroup leads to authorization bypass. The attack may be launched remotely...

CVE-2026-19066

SourceCodester Online Examination & Learning Management System 1.0 contains a vulnerability in view_students.php where manipulating the class_group argument enables authorization bypass. The issue is exploitable remotely and affects an unknown function within the file. No additional exploit, affe...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

CVE-2026-19061

CVE-2026-19061 affects Insta InstaKNXServiceApp 1.2.3.1469, specifically the Firmware Update Handler’s CreateWebClientAndDownloadFileList function. The issue is insufficient verification of data authenticity, with exploitation described as remote and technically complex. No remediation or version...

CVE-2026-19061 Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity

A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attac...

GHSA-CXJQ-MRR5-89RV Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Summary There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator for example regex: "^/api.", replacement: "/$1", a crafted request ca...

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Summary There is a critical authentication-bypass vulnerability in Traefik's ReplacePathRegex middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator for example regex: "^/api.", replacement: "/$1", a crafted request ca...

CVE-2026-19060 FoundationAgents MetaGPT code injection

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure...

CVE-2026-19060

FoundationAgents MetaGPT (up to 0.8.2) is vulnerable to a code-injection issue described as affecting an unknown function; exploitation requires local access. An exploit is publicly available. The CVE entry notes the vendor was contacted but did not respond. The provided metrics indicate medium s...

CVE-2026-19059

FoundationAgents MetaGPT (up to version 0.8.2) contains a path traversal flaw in metagpt/tools/libs/editor.py: the read function is vulnerable, enabling local attackers to traverse the filesystem. The issue is local-access, with a publicly disclosed exploit. Vendor contact about the disclosure oc...

CVE-2026-19059 FoundationAgents MetaGPT editor.py read path traversal

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...