CVE-2026-124622

A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the...

EUVD-2026-119981

A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function localiomadpluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be...

EUVD-2026-119924

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function loadstatedictintomodel of the file omgllava/xtuner/utils/handlemoeloadandsave.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weightm...

EUVD-2026-119898

A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.0. The impacted element is the function resolvecomponentcls of the file finetrainers/utils/model.py of the component Model Index Handler. Performing a manipulation of the argument Library results in code injection. The atta...

EUVD-2026-119889

A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-124590

The zhangbw409 library_manager_system (f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b) is vulnerable to an improper authorization flaw in the BookController.addBook function located at src/main/java/com/zbw/controller/UserController.java. By manipulating the use...

CVE-2026-124591

A vulnerability exists in Bahleel versions 0.1.0 and 0.1.1 within the fputcsv function of the app/Exporters/CsvExporter.php file. This flaw allows for CSV injection , which may be triggered via a remote attack . While the project was notified of the issue through an issue report, no response or o...

CVE-2026-113702

A security flaw exists in iomad versions up to 4.5.15, 5.0.11, 5.1.8, and 5.2.4 . The vulnerability affects the local_iomad_pluginfile function within the public/local/iomad/lib.php library of the PDF Certificate Handler component. An attacker can perform a remote attack resulting in an authoriza...

CVE-2026-124588

A security flaw in huggingface finetrainers versions 0.1.0 and 0.2.0 allows for code injection via a remote attack. The vulnerability is located in the resolve_component_cls function within the finetrainers/utils/model.py file, specifically affecting the Model Index Handler component. The root ca...

CVE-2026-124589

The lxtGH OMG-Seg software (up to commit f3b26b609bae919760cd3ccf09c36179bb8624a0 ) is vulnerable to a path traversal flaw in the MoE Shard Checkpoint Loader component. Specifically, the load_state_dict_into_model function within omg_llava/xtuner/utils/handle_moe_load_and_save.py fails to properl...

CVE-2026-65139

A flaw was found in Slurm. An authenticated local attacker can trigger an SQL injection vulnerability by sending crafted requests to certain Slurm Database Daemon SlurmDBD remote procedure calls RPCs. Successful exploitation allows the attacker to execute arbitrary code on the underlying system...

Hob0Rules

Hob0Rules Password cracking rules for Hashcat based on statistics and industry patterns. The following blog posts on passwords explain the statistical signifigance of these rulesets: Statistics Will Crack Your Password Praetorian Password Cracking Rules Released Useful wordlists to utilize with...

CVE-2026-124576

A security flaw exists in BeikeShop versions up to 2.0.0.31 within the Guest Order Lookup component. The vulnerability is located in the OrderRepo::getOrderByNumber function of the beike/Repositories/OrderRepo.php file. By manipulating the order_number argument, an attacker can trigger an enforce...

CVE-2026-124575

A vulnerability exists in SiteServer SSCMS versions up to 7.1.3, 7.2.1, and 7.4.0. The flaw resides in the Admin-Login CAPTCHA component, specifically within the LoginController.Submit function located in src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs. Manipulation of the isForceLogout...

CVE-2026-124572

A path traversal vulnerability exists in the DataLinkDC dinky software, affecting versions up to 1.2.5 . The flaw is located within the Catalogue Upload API component, specifically in the CatalogueController.upload function of the dinky-admin/src/main/java/org/dinky/controller/CatalogueController...

EUVD-2026-119837

A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. Th...

CVE-2026-124571

A SQL injection vulnerability exists in the SourceCodester Simple CRUD application (using PHP and FPDF 1.0). The flaw is located within an unknown functionality of the app/register.php file. An attacker can execute a remote attack by manipulating the firstname argument to perform unauthorized dat...

EUVD-2026-119816

A flaw has been found in SourceCodester Simple CRUD using PHP and FPDF 1.0. Affected by this vulnerability is an unknown functionality of the file app/register.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack can be executed remotely. The exploit has...

CVE-2026-124569

A vulnerability exists in fushengqian fuintCatering (up to commit 6d054f5788ac8645eb491f79242bb8a625efc133) within the CommissionCashServiceImpl.java file. The updateCommissionCash function is susceptible to improper access controls due to the manipulation of the Status argument. This flaw allows...

CVE-2026-124568

A vulnerability exists in fushengqian fuintCatering (up to version 6d054f5788ac8645eb491f79242bb8a625efc133) within the Refund Agreement component. The RefundServiceImpl.agreeRefund function is susceptible to improper access controls (CWE-284, CWE-266) through manipulation. Attackers can potentia...