CVE-2026-103117: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function dbproperties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

CVE-2026-103475: Active Debug Code

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

CVE-2026-103229: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqliquery of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results i...

CVE-2026-103231: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-102843: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/datagaleri.php of the component Endpoint. Performing a manipulation of the argument gbr results i...

CVE-2026-102842: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

Breaking the Bounded Entanglement Barrier for Quantum Position Verification

Position verification, introduced by Chandran et al. SIAM J. Computing 2014, allows verifiers to test a prover's claimed position by an interactive protocol. Classical position verification is impossible. Even for Quantum Position Verification QPV, there always exists an LOCC Local Operations and...

Link Inference Attack on Privacy-Preserving Knowledge Graphs

Knowledge Graphs KGs are widely used to store and share structured information across sensitive domains such as healthcare, fi- nance, and social networks. A common privacy practice is to delete sen- sitive relations before publishing the graph, under the assumption that removing edges is...

PT-2026-103078

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An SQL Injection flaw allows authenticated remote attackers to inject arbitrary SQL commands, enabling them to read sensitive database contents. Recommendations At the moment, there is ...

PT-2026-103331

A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection...

PT-2026-103324

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19197 Description An issue exists that allows account takeover by replaying a notification signature. Recommendations Update to version 2026.2.19197...

PT-2026-103269

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

PT-2026-103080

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Missing authentication allows unauthenticated remote attackers to obtain the plaintext passwords of other users through a specific API endpoint. Recommendations At the moment, there is ...

PT-2026-103529

Name of the Vulnerable Software and Affected Versions Kiteworks Secure Data Forms versions prior to 9.5.0 Description An issue exists that allows an unauthenticated remote attacker to perform Server-Side Request Forgery SSRF, a technique where the attacker induces the server to make requests to a...

CVE-2026-102456: Improper Neutralization of Special Elements used in an SQL Command

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents...

PT-2026-103000

A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...

CVE-2026-103222: Integer Overflow or Wraparound

A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclzdecompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is...

Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics

Recently, Vision-Language-Action VLA models have revolutionized robotic manipulation by seamlessly integrating visual perception, language understanding, and action generation in an end-to-end learning framework. However, since these models are designed to interact directly with the physical worl...

CVE-2026-51862

DB-GPT version 0.8.0 is vulnerable to a directory traversal issue within the skill_upload function located in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40. This flaw allows a remote attacker to bypass intended workspace or storage boundaries to write files in unauthorize...

PT-2026-102979

A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument...