CVE-2026-114266 ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqliquery of the file profile.php. The manipulation of the argument adminid leads to sql injection. The attack is possible to be carried out remotely. The exploit has be...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...

DRUPAL-CONTRIB-2026-253

This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This...

EUVD-2026-107472

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...

CVE-2026-105935

The Apache Pulsar Functions Worker contains a vulnerability where a REST API endpoint for triggering functions publishes caller-supplied values to input topics without verifying if the caller has produce permissions for those specific topics. The worker uses its own broker-client credentials for ...

CVE-2026-105935

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...

CVE-2026-105935 Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...

CVE-2026-105930 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...

CVE-2026-114265

The ProjectWorlds Advanced Library Management System 1.0 is vulnerable to SQL injection via the Search Form component. The flaw exists in the mysqli_query function within the returned_book_search.php file, where improper handling of the datefrom and dateto arguments allows for remote execution. P...

CVE-2026-114265 ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqliquery of the file returnedbooksearch.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be...

EUVD-2026-107425

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqliquery of the file returnedbooksearch.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be...

shai-scan

shai-scan Zero-dependency CLI scanner for npm and PyPI supply chain compromises. Why? On May 11, 2026, a self-propagating supply chain worm dubbed Mini Shai-Hulud CVE-2026-45321, GHSA-g7cv-rxg3-hmpx compromised the npm ecosystem. Attributed to TeamPCP aka DeadCatx3, PCPcat, ShellForce, CipherForc...

CVE-2026-90012

A flaw was found in the Linux kernel's Serial Peripheral Interface SPI subsystem. When handling Direct Memory Access DMA mappings, an issue arises if a receive RX mapping fails after a transmit TX mapping succeeds, or if a TX mapping fails during a subsequent transfer. This can lead to incorrect...

CVE-2026-80752

A flaw was found in the Linux kernel's psxpad-spi driver. This vulnerability occurs because the psxpadspisuspend function attempts to access controller state before it has been properly initialized, leading to a null pointer dereference. A local attacker could exploit this to cause a system crash...

cPanelWHM-AuthBypass

cPanel/WHM Auth Bypass Scanner & Exploit Tool A Go command-line tool rewritten from the Python PoC by watchTowr, used to detect and exploit the CVE-2026-41940 cPanel/WHM authentication bypass vulnerability. Vulnerability Overview CVE-2026-41940 is an authentication bypass vulnerability in...

CVE-2026-114264

The ProjectWorlds Advanced Library Management System 1.0 is vulnerable to a SQL injection flaw within an unknown function in the edit_member.php file. Attackers can manipulate the firstname , middlename , lastname , address , branch , or type arguments to execute the injection. Remote exploitatio...

CVE-2026-114264 ProjectWorlds Advanced Library Management System edit_member.php sql injection

A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file editmember.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote...

EUVD-2026-107415

A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file editmember.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote...

CVE-2026-114129

The stream-json micro-library (versions 2.0.0 through 3.7.0 ) is vulnerable to a CPU denial of service due to inefficient algorithmic complexity in the FlexAssembler component. When processing string or regular-expression path filters, the library joins the full key stack on every container start...

CVE-2026-114129

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full key stack on every container start. Because the key stack...