CVE-2026-84914

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3...

CVE-2026-84914 Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3...

CVE-2026-84914 Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3...

CVE-2026-84914

The Calculate Working Days Drupal module (versions 0.0.0 to 2.0.3 ) is vulnerable to a Missing Authorization flaw (CWE-862 ). The module fails to sufficiently restrict access to its settings form , which allows for Forceful Browsing . An attacker could potentially access and modify configuration ...

EUVD-2026-107877

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3...

CVE-2026-105107 Koha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

Astra Linux – Vulnerability in faad2

There is a stack-based buffer overflow in the third instance of the calculategain function in libfaad/sbrhfadj.c in Freeware Advanced Audio Decoder 2 FAAD2 2.8.8. A crafted input will lead to a denial of service or possibly unspecified other impacts, as the SM array is mishandled...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fixed an out-of-bounds shift in CalculateVMAndRowBytes. REASON When PTEBufferSizeInRequests is zero, UBSAN reports the following warning because dmllog2 returns an unexpected negative value: The shift exponent...

DRUPAL-CONTRIB-2026-122

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

PT-2026-84890

Name of the Vulnerable Software and Affected Versions Calculate Working Days versions 0.0.0 through 2.0.3 Description An authorization flaw in the Calculate Working Days module allows forceful browsing. The module fails to sufficiently restrict access to its settings form, which could allow...

Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

PT-2026-67707

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/issues avg stats.pl script builds dynamic SQL within the calculate function by concatenating user-controlled request parameters directly into the query string. The Line and Column...

PT-2026-67706

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/catalogue stats.pl script builds dynamic SQL within the calculate function by interpolating user-controlled Line and Column request parameters directly into identifier positions of t...

PT-2026-67705

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description An authenticated staff user with reports module permissions can perform SQL injection via the reports/acquisitions stats.pl endpoint. The issue occurs in the calculate function, where...

PT-2026-67709

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The circulation statistics report in reports/issues stats.pl contains a flaw where the calculate function constructs SQL queries by concatenating user-controlled request parameters directly into...

PT-2026-67708

Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/bor issues top.pl script builds dynamic SQL within the calculate function by concatenating user-controlled request parameters directly into the query string. The Criteria parameter i...

mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption

A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.helpers.calculatedataframehash of the file mlrun/utils/helpers.py of the component DataFrame Hash Handler. The manipulation leads to use of weak hash. The attack can only be performed from a local...

CVE-2026-47391

PraisonAI’s first-party A2A example exposes an unauthenticated /a2a JSON-RPC surface and registers a calculate(expression) tool implemented via Python eval(), bound to 0.0.0.0. A remote attacker can send message/send to a2a, causing the LLM to invoke the unsafe tool and potentially execute arbitr...

EUVD-2026-46281

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

PYSEC-2026-1591 LoLLMS Code Injection vulnerability

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module...