API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

Summary The API Platform serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. Impact An attacker who can submit write requests...

GHSA-9RJG-X2P2-H68H API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

Summary The API Platform serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. Impact An attacker who can submit write requests...

CVE-2026-67585 Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the checkunsafeoptions process. An attacker can execute arbitrary OS commands by supplying specially crafted keyword arguments that...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the setvalue process. An attacker can execute arbitrary commands by injecting specially crafted option names that are written verbatim...

CVE-2026-19209 SourceCodester Photo Share Website index.php home cross site scripting

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the fromtree, reset, or mergetree process. An attacker can overwrite or destroy arbitrary files with a valid git-index blob by injecti...

PT-2026-69065

Name of the Vulnerable Software and Affected Versions SourceCodester Photo Share Website version 1.0 Description A remote cross-site scripting issue exists in the /social/index.php?page=home endpoint. The flaw occurs when the Comment argument is manipulated, allowing an attacker to execute...

PT-2026-69098

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploi...

PT-2026-76730

The RSA decrypt and encrypt functions raise an Invalid argument exception if the message is smaller than 2. This leads to X509 certificates with a signature value of 0 or 1 to throw this Invalid argument exception instead of a proper error. Fix The fix is to reuse the Insufficient key exception,...

CVE-2026-19231: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=deleteappointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit...

CVE-2026-66808

A flaw was found in hypershift-addon-operator. A hub-cluster administrator with write access to the hypershift-operator-install-flags ConfigMap can inject malicious command-line arguments into the privileged install Job. This vulnerability, known as argument injection, allows the attacker to pull...

CVE-2026-19047 NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...

CVE-2026-19046 NocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversal

A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...

CVE-2026-19046

CVE-2026-19046 affects NocteDefensor LudusMCP (up to 1.0.24). The vulnerable element is an unknown function in src/tools/ludusEnvironmentGuidesSearch.ts of the ludus_environment_guides_search component. According to the description, manipulating the guide_name argument enables path traversal, wit...

CVE-2026-19036

Shibby Tomato CVE-2026-19036 affects the wanoptions component: the function sub_40F88C in /tmp/ppp/wanoptions is vulnerable when processing the ppp_custom argument, enabling OS command injection. The issue can be triggered remotely, and public exploits exist. The affected product/version is Shibb...

EUVD-2026-53868

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument pppcustom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may...

EUVD-2026-53697

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...

EUVD-2026-53674

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...

PT-2026-68679

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 5.0.0 Description Cross site scripting occurs in the Chart Name Handler component due to improper handling of the Title argument within the HtmlTplDashboardWidgetHtmlRenderer function of the...