tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy

A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses...

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication

A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls...

EUVD-2026-83867

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero...

CVE-2026-94149

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2026-94149 Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

EUVD-2026-83859

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource...

CVE-2026-94149

Omega Solution HRM OS (versions up to 20260717) is affected by an improper control of resource identifiers flaw in the Role Permission Retrieval Endpoint at /role-permission/permission. Manipulating the roleId argument allows a remote, authenticated attacker (low privileges) to access permission ...

CVE-2026-94145

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94148 ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure

A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/exportproject.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been...

CVE-2026-94146 BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...

CVE-2026-94146 BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...

EUVD-2026-83847

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...

CVE-2026-94146

BioStar BIOS Update Utility 1.9.7.3 contains a write-what-where flaw in the IOCTL Handler (function sub_110BC of BSMEM64_W10.sys), triggered by manipulating the PhysicalAddress/Size argument. A local attacker with low privileges can achieve high impact on confidentiality, integrity, and availabil...

CVE-2026-94145 xuxueli xxl-job Task Management JobInfoController.java cross site scripting

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-94144 drogonframework drogon ORM Criteria.cc makeCriteria sql injection

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library ormlib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-94144 drogonframework drogon ORM Criteria.cc makeCriteria sql injection

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library ormlib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been...

apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

EUVD-2026-83836

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...