115806 matches found
CVE-2026-105798: Improper Neutralization of Input During Web Page Generation
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...
CVE-2026-105703: Incorrect Authorization
A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes...
Linux Distros Unpatched Vulnerability : CVE-2026-59788
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in th...
Linux Distros Unpatched Vulnerability : CVE-2026-105263
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file...
PT-2026-106719
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password resul...
CVE-2026-101207: Improper Neutralization of Special Elements used in an OS Command
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...
EUVD-2026-93552
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...
PT-2026-106511
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the mac80211 wireless subsystem where a monitor interface may be activated without a transmit queue TXQ. This occurs because setting the active flag on a down interface i...
PT-2026-106607
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A routing loop can be configured by a user with CAP NET ADMIN privileges. When ipip fill forward path or ip6 tnl fill forward path look up the route to a tunnel's remote endpoint and the...
PT-2026-106563
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the hhf change function stores the TCA HHF HH FLOWS LIMIT attribute without an upper bound. An excessively large hh flows limit allows ne...
PT-2026-106513
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A heap buffer overflow exists in the mwifiex cfg80211 authenticate function. The issue occurs because the authentication frame length is derived from req-ie len and req-auth data len both...
PT-2026-106804
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...
CVE-2026-105468
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql...
CVE-2026-105468
The girishsaraf Online-Appointment-Booking-System is vulnerable to a SQL injection flaw within the Login Handler component, specifically affecting the mysqli_query function in the Admin/mlogin.php file. An attacker can initiate a remote attack by manipulating the uname or pass arguments. While th...
CVE-2026-77226
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...
CVE-2026-77226
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...
CVE-2026-77226
The Camunda engine, specifically versions 7.24.0 before 7.24.15 , is vulnerable to an incorrect authorization flaw in the Admin web application's first-run setup endpoint. The SetupResource component incorrectly determines setup availability by only counting direct members of the camunda-admin gr...
EUVD-2026-92791
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...
CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...
CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...