EUVD-2026-63108

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information...

EUVD-2026-63103

In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Observability Cloud access token stored fo...

CVE-2026-76764

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

CVE-2026-76764 code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

EUVD-2026-63186

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

CVE-2026-76764

code-projects Employee Management System 1.0 is vulnerable to SQL injection via the mailuid argument in /process/aprocess.php (Admin Login Endpoint). CVSS 7.3 HIGH. Exploit proof-of-concept published; no patch version provided. Exploitation details not available in provided documents.

PT-2026-78873

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

Exploit for CVE-2026-76071

CVE-2026-76071: Unauthenticated Pre-Auth Stack Buffer Overflow...

Exploit for CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow...

MAL-2026-14308 Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a46929f4ba4ca97beaf5511f0be0af36c4d1e9deff65bea3821137c2c258eb9c During import, the code obfuscated in native extension downloads malicious remote executable and establishes persistence via registry keys. Downloaded binary...

Malicious code in libasync (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a46929f4ba4ca97beaf5511f0be0af36c4d1e9deff65bea3821137c2c258eb9c During import, the code obfuscated in native extension downloads malicious remote executable and establishes persistence via registry keys. Downloaded binary...

Malicious code in express-route-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f54041362d71f16d1ee889c3992558cec28371030eaca4a3962ac0e9e3ec55d On require/import, index.js immediately invokes an initializer that HTTP-GETs a JSON document from...

MAL-2026-14307 Malicious code in express-route-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f54041362d71f16d1ee889c3992558cec28371030eaca4a3962ac0e9e3ec55d On require/import, index.js immediately invokes an initializer that HTTP-GETs a JSON document from...

CVE-2026-76878

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

CVE-2026-76405

In Splunk On-Call VictorOps app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface API key from the App Key Value Store KV Store. The exposure is possible because the Splunk On-Call...

CVE-2026-76404

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

CVE-2026-76398

In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user without permission through the Representational State Transfer REST API. The vulnerability is possible because Splunk AI Toolkit deletes...

CVE-2026-76391

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improp...

CVE-2026-76392

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for...

CVE-2026-76394

In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfer REST API. The missing authorization ...