CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

CVE-2026-19037

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::updatelob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote...

EUVD-2026-53871

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::updatelob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote...

CVE-2026-19037

WonderTrader up to version 0.9.9 contains a vulnerability in the Internal Limit Order Book Cache Handler, specifically in MatchEngine::update_lob (src/WtBtCore/MatchEngine.cpp). The issue enables manipulation that enforces a different behavioral workflow and is remotely exploitable. Public exploi...

CVE-2026-19037 WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::updatelob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote...

CVE-2026-71241

CVE-2026-71241 affects a Book-Management-System built with Flask. Several endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) are missing the @login_required decorator that protects related routes (/search_student, /storage). This misconfiguration allows any unauthenticat...

Multiple vulnerabilities in Sharp and Toshiba Tec MFPs

Overview Sharp and Toshiba Tec MFPs multifunction printers contain multiple vulnerabilities listed below. User authentication can be bypassed with crafted URLs CWE-425 - CVE-2026-60011 Incomplete cleanup of cached files CWE-459 - CVE-2026-63545 Insecure initial configuration CWE-1188 -...

CVE-2026-63563

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

EUVD-2026-52251

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

CVE-2026-63563

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

CVE-2026-63563

Sharp and Toshiba Tec MFPs multifunction printers for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accesse...

CVE-2026-63563

Sharp and Toshiba Tec MFPs shipped for a market with the user authentication feature disabled by default. When used with this initial configuration, address book editing and Document Filing features can be accessed without authentication, potentially exposing sensitive configuration data. The aff...

Xerox Printers Improper Authentication (CVE-2023-46327)

Multiple MFPs multifunction printers provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encrypti...

CVE-2026-57962

A flaw was found in Thunderbird. A remote attacker, by operating a malicious Lightweight Directory Access Protocol LDAP server, can cause a Thunderbird client to crash due to memory exhaustion. This occurs when a user's Thunderbird client is configured to query the malicious LDAP server for...

EUVD-2026-43296

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/requi...

EUVD-2026-43295

A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. T...

EUVD-2026-43282

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-15540

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/requi...

CVE-2026-15539

A security vulnerability has been detected in SourceCodester Online Book Store System 1.0. Impacted is an unknown function of the file /admin/index.php?page=books of the component Book Image Upload Feature. Such manipulation leads to unrestricted upload. The attack may be performed from remote. T...

CVE-2026-15537

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the...