CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2023-40297

CVE-2023-40297 Stakater Forecastle = v1.0.144 permite recorrido de directorios en el componente del sitio web Vulnerability Type Directory Traversal Vendor of Product Stakater Affected Product Code Base Forecastle = v1.0.144 Affected Component Componentes afectados: URL -...

CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105287

A SQL injection vulnerability exists in feelec-yishu feelcrm-os 1.0.0 within the getMemberByGroups endpoint. The flaw is caused by the manipulation of the groups[] argument in an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php . This vulnerability can be ex...

CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105286 Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit...

scan-shai-hulud

scan-shai-hulud Un escáner Bash rápido y sin dependencias para detectar si tu máquina está afectada por el ataque a la cadena de suministro CVE-2026-45321 "Mini Shai-Hulud". El 11 de mayo de 2026, más de 170 paquetes npm y 2 paquetes PyPI de TanStack, Mistral AI, UiPath, OpenSearch y Guardrails A...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105251

A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function psfindpadding of the file src/coding/psxdecoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. Th...

CVE-2026-105253

A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed...

CVE-2026-104854

A flaw was found in Nx. The application creates communication endpoints Unix domain sockets for its background service and worker processes in shared temporary directories without proper access permissions or authentication. A local attacker sharing the same system can connect to these endpoints ...

EUVD-2026-92331

A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has bee...

mt6985-CVE-2026-43499

CVE-2026-43499 Failure Log: MT6985 Adaptation Attempt Conclusion : Spent 68M tokens, no root obtained. Reason : KernelSnitch timing attack is unreliable on MTK Dimensity 9200, and CONFIGPANICONOOPS=y leaves no room for trial and error. This article documents the complete troubleshooting process f...

EUVD-2026-92316

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-38764

CVE-2026-38764 An issue in Unistal Systems Pvt. Ltd. Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys...

CVE-2026-105254 itsourcecode Online Admission System schoolyear.php sql injection

A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...

EUVD-2026-92297

A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...

Security update for rpcbind

This update for rpcbind fixes the following issue: CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service bsc1282326. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

CVE-2026-105247

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/Subject/btnfunctions.php?action=course. Executing a manipulation of the argument Subject can lead to sql injection. The...