CVE-2026-94148 ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure

A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/exportproject.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been...

EUVD-2026-83847

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...

CVE-2026-94146

BioStar BIOS Update Utility 1.9.7.3 contains a write-what-where flaw in the IOCTL Handler (function sub_110BC of BSMEM64_W10.sys), triggered by manipulating the PhysicalAddress/Size argument. A local attacker with low privileges can achieve high impact on confidentiality, integrity, and availabil...

CVE-2026-94146 BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...

CVE-2026-94144 drogonframework drogon ORM Criteria.cc makeCriteria sql injection

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library ormlib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-94144 drogonframework drogon ORM Criteria.cc makeCriteria sql injection

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library ormlib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been...

apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

EUVD-2026-83836

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

CVE-2026-94142

BioStar Temperature Monitor Utility 1.2.1806.2200 contains a write-what-where vulnerability in the IOCTL Handler component, specifically in the function sub_1105C of the kernel driver BS_HWMIO64_W10.sys . Manipulation of the PhysicalAddress argument allows a local attacker with low privileges to ...

CVE-2026-94137

A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. This affects the function sub180004AC0 of the file shdrvx64.sys of the component IRPMJDEVICECONTROL Handler. The manipulation of the argument PID leads to denial of service. The attack must be carried out locally...

EUVD-2026-83831

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

CVE-2026-94137

Hangzhou Shunwang Technology shzh version 10.7.2.693 contains a denial-of-service vulnerability in the driver file shdrv_x64.sys , specifically in the function sub_180004AC0 within the IRP_MJ_DEVICE_CONTROL handler. The root cause is improper handling of the PID argument, which allows a local att...

CVE-2026-94129

A write-what-where vulnerability exists in the IOCTL Handler (function sub_1105C) of the BS_RVSIO64.sys driver within BioStar VALKYRIE AURORA 2.10.2411.0800 . Manipulating the PhysicalAddress argument allows an attacker with local access to write arbitrary data to arbitrary memory, resulting in a...

kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation

A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas VMAs. By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This...

CVE-2026-94102

An open redirect vulnerability exists in WuzhiCMS up to 4.1.0 , specifically in the Login component at /index.php?m=member&v=Login. The root cause is that the forward argument is only sanitized by remove_xss(), an XSS keyword/entity scrubber, which is insufficient to prevent a crafted redirect UR...

EUVD-2026-83802

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/networktools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be...

CVE-2025-12999: Insufficient Verification of Data Authenticity

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header...

CVE-2026-94214: URL Redirection to Untrusted Site

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to...

CVE-2026-94101: Buffer Copy without Checking Size of Input

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlanloadformuci of the file /usr/bin/routerd. The manipulation of the argument wannum leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has be...

CVE-2026-94534: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex...