CVE-2026-108379

The dataclasses-avroschema library (versions 0.38.0 through 0.70.5 ) contains a code injection vulnerability. The BaseGenerator.parse_fixed function fails to escape or validate a fixed type's namespace value when generating Python code from Avro schemas. An attacker can provide a crafted quote to...

CVE-2026-23706

Fortinet FortiAnalyzer and FortiManager products are affected by an SQL Injection vulnerability [CWE-89] caused by improper neutralization of special elements in SQL commands. The flaw impacts FortiAnalyzer versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, all 7.2 versions, and various FortiAnal...

CVE-2026-23707

A SQL Injection vulnerability (CWE-89 ) exists in several versions of Fortinet FortiAnalyzer and FortiManager products, including FortiAnalyzer (7.6.0-7.6.4, 7.4.0-7.4.7, 7.2 all versions), FortiAnalyzer Cloud, and FortiManager (7.6.0-7.6.4, 7.4.0-7.4.6, 7.2 all versions), as well as FortiManager...

CVE-2026-23706

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.2.1...

CVE-2026-23706

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.6, FortiAnalyzer Cloud 7.2.1...

CVE-2025-46773

A SQL Injection vulnerability [CWE-89] exists in Fortinet FortiAnalyzer (versions 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2 versions) and FortiAnalyzer Cloud (versions 7.6.2-7.6.4, 7.4.1-7.4.7, and 7.2.1-7.2.11). This flaw allows a low privileged user to execute arbitrary commands through specially c...

CVE-2026-23705

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all...

CVE-2026-23705

A SQL Injection vulnerability (CWE-89 ) exists in Fortinet FortiAnalyzer (versions 7.6.0–7.6.4, 7.4.0–7.4.7, and all 7.2 versions) and FortiManager (versions 7.6.0–7.6.4, 7.4.0–7.4.6, and all 7.2 versions). This flaw arises from improper neutralization of special elements in SQL commands, which m...

CVE-2026-23707

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-23705

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all...

CVE-2025-46773

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-78799

Directory Traversal vulnerability in Quanxun Huiju Network Technology Beijing Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: = iKuai83.7.23Enterprise Build 202606021825 - Free Edition: = iKuai 84.0.304-beta allows a remote attacker to execute arbitrary code...

CVE-2026-110115

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...

CVE-2026-110116

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or...

CVE-2026-108375

The dataclasses-avroschema library (versions 0.38.0 through 0.70.5 ) is vulnerable to code injection when generating Python code from Avro schemas. The root cause lies in how the library handles field defaults and fixed types: FieldRepresentation.get_field_default fails to escape schema-controlle...

CVE-2026-109964

A flaw was found in ImageMagick. A remote attacker can exploit this vulnerability to achieve arbitrary code execution or trigger an application crash, resulting in a denial of service DoS. By providing a specially crafted PICT image file with manipulated dimension values, an integer overflow occu...

CVE-2026-109956

A flaw was found in NLTK. A path traversal vulnerability in the WekaClassifier module allows an attacker to bypass directory containment restrictions by supplying unvalidated model paths. By controlling these path arguments, an attacker can write arbitrary files or probe existing files outside of...

CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

CVE-2026-93190

A flaw was found in the crosectypec component of the Linux kernel. The crostypecregisterpartnerpdos function does not properly validate the sourcecapcount and sinkcapcount values received from the Embedded Controller EC. An attacker could potentially provide manipulated count values, leading to a...

CVE-2026-93189

A flaw was found in the Linux kernel's Human Interface Device HID core. When a driver's probe fails after enabling input delivery, the hidhwstop function may free a hidraw structure while in-flight HID reports are still being processed. This timing issue can lead to a use-after-free vulnerability...