CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...

CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...

CVE-2026-113378

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-113381

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

CVE-2026-113382 arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/apiplugins.php of the component Plugin Installer. Such manipulation of the argument pluginfile leads to unrestricted upload. The attack may be...

CVE-2026-113382 arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/apiplugins.php of the component Plugin Installer. Such manipulation of the argument pluginfile leads to unrestricted upload. The attack may be...

CVE-2026-113382

The arizu-id fast-tunnel software (version 1.0.0 ) contains a vulnerability in the Plugin Installer component. Specifically, the backend/api_plugins.php file utilizes the ZipArchive::extractTo function in a way that allows an attacker to manipulate the plugin_file argument. This flaw leads to an ...

CVE-2026-113381 Osclass Item Model Item.php findUserItems sql injection

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

CVE-2026-113381 Osclass Item Model Item.php findUserItems sql injection

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

CVE-2026-113381

A SQL injection vulnerability exists in Osclass up to version 8.3.1 . The flaw is located within the Item Model Handler component, specifically in the Item::findUserItems function of the file oc-includes/osclass/model/Item.php. The root cause is the improper handling of the sPattern argument, whi...

EUVD-2026-104877

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiate...

EUVD-2026-104861

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-113378

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-113378 mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-113378

A security flaw in mcollina mcp-ripgrep (up to version 0.4.0 ) allows for OS command injection within the Advanced Search Tool component. The vulnerability exists in an unknown function of the src/index.ts file, where the manipulation of the fileType argument leads to command injection due to a C...

CVE-2026-113378 mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has...

CVE-2026-98662

A flaw was found in the Linux kernel's gp2ap020a00f ambient light sensor driver. During device removal or initialization failure, the driver fails to properly drain scheduled interrupt tasks before releasing memory structures. A local user capable of unbinding or disconnecting the device can...

CVE-2026-98748

A flaw was found in the Linux kernel's Broadcom serial driver. A local attacker could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. During device removal, an incoming interrupt can restart a timer after it has been cancelled, leading to a use-after-free...

CVE-2026-98475

A flaw was found in the Linux kernel's s390 Channel Measurement Facility CMF. This vulnerability can allow a local user to cause memory corruption or a Denial of Service DoS due to confusion between virtual and physical memory addresses. When extended format channel measurement data is recorded o...

CVE-2026-113406

The BA-Workflow software developed by YS-infoware is vulnerable to a SQL Injection (CWE-89). This flaw allows authenticated remote attackers to inject arbitrary SQL statements, potentially resulting in the unauthorized reading, modification, or deletion of database contents. Specific information ...