CVE-2026-104053: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file adminreservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-104638: Improper Authentication

A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...

CVE-2026-63573: Observable Discrepancy

Observable discrepancy in the CMS RSA PKCS1 v1.5 key-transport unwrap KeyTransRecipientInformation.UnwrapKey in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an...

PT-2026-104209

Name of the Vulnerable Software and Affected Versions GRUB affected versions not specified Description A local attacker with control over the configuration can bypass lockdown restrictions during Secure Boot to load an unsigned module. The issue stems from insufficient validation of the MMIO...

ColdFusion Code Execution

The vulnerability of the ColdFusion software platform lies in the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PyJWT OKPAlgorithm from_jwk Buffer Overflow

The vulnerability of the PyJWT OKPAlgorithm.fromjwk function in the jwt/algorithms.py library is related to the use of an unreliable source. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-104406

Name of the Vulnerable Software and Affected Versions Nx versions prior to 22.7.9 Nx versions 23.0.0 through 23.1.1 Description Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without restricting permissions to the owner. On shared build...

Linux Distros Unpatched Vulnerability : CVE-2026-103431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it,...

Fedora 45 : cockpit-machines (2026-2afda0f514)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2afda0f514 advisory. Automatic update for cockpit-machines-357-1.fc45. Changelog for cockpit-machines Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from...

Linux Distros Unpatched Vulnerability : CVE-2026-86345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an...

Linux Distros Unpatched Vulnerability : CVE-2026-97876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while...

PT-2026-104238

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent error map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates,...

PT-2026-104105

Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC...

VulnCheck KEV: CVE-2020-37278

Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...

Defense-In-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Large Language Models LLMs increasingly support Uncrewed Aerial Vehicle UAV swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without...

Flysystem normalizePath() Path Traversal

The vulnerability of the normalizePath function in the src/WhitespacePathNormalizer.php file of the Flysystem library is related to the failure to take measures to eliminate special elements. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of the protected...

PyJWT HMAC Algorithm Unauthorized Access

The vulnerability of the HMACAlgorithm.fromjwk method in PyJWT is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-104300

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast setting internet set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be...

PT-2026-104122

Release of unverified plaintext in the CCM CcmBlockCipher and DSTU 7624 CCM KCcmBlockCipher AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets th...

ROS-20261002-73-0034

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...