CVE-2026-32709

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP implementation allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on the flight controller filesystem withou...

CVE-2026-4234 SSCMS DDL SitesAddController.Submit.cs sql injection

A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-4200 glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery

A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in...

CVE-2026-4200

A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in...

Craft CMS 安全漏洞

Craft CMS is an open-source content management system developed by Craft CMS. Vulnerabilities existed in versions 4.0.0-RC1 to 4.17.5, as well as in versions 5.0.0-RC1 to 5.9.11 of Craft CMS. These vulnerabilities were caused by behavior injection remote code execution vulnerabilities in the...

The vulnerability of the k230_pinctrl_probe() function in the drivers/pinctrl/pinctrl-k230.c driver module of the Linux operating system’s GPIO controller driver allows a hacker to cause a service failure.

The vulnerability of the k230pinctrlprobe function in the drivers/pinctrl/pinctrl-k230.c driver for Linux kernel’s PINCTRL output controllers relates to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a system failure...

glowxq-oj 代码问题漏洞

Glowxq-oj is an online problem-solving system developed by Glowxq’s individual developers, which supports multi-language evaluations and engaging programming activities. There are code vulnerabilities in Glowxq-oj. These vulnerabilities stem from incorrect operations on the function...

glowxq-oj 代码问题漏洞

Glowxq-OJ is an online problem-solving system developed by Glowxq’s individual developers, which supports multi-language evaluations and engaging programming activities. There are code vulnerabilities in Glowxq-OJ. These vulnerabilities stem from incorrect operations related to the function Uploa...

PT-2026-29735

Name of the Vulnerable Software and Affected Versions ShareFile Storage Zones Controller SZC affected versions not specified Description An access control flaw in the Customer Managed ShareFile Storage Zones Controller SZC allows an unauthenticated attacker to access restricted configuration page...

PT-2026-25576

Name of the Vulnerable Software and Affected Versions glowxq glowxq-oj affected versions not specified Description A weakness exists in glowxq glowxq-oj. This issue affects the Upload function within the file...

PT-2026-25804

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.6.0 through 5.9.10 Description Craft CMS is a content management system. A flaw exists where the $settings array from parse str is passed directly to Craft::configure without proper sanitization using...

The vulnerability of the send_ipi_data() function in the arch/loongarch/kvm/intc/ipi.c module, which is part of the LoongArch architecture support for the Linux operating system, allows a attacker to cause a service failure.

The vulnerability of the sendipidata function in the arch/loongarch/kvm/intc/ipi.c module, which is part of the LoongArch architecture support for the Linux operating system, relates to memory writing beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to cause a...

SSCMS SQL注入漏洞

SSCMS SiteServerCMS is a content management system developed by SSCMS Corporation in China. Version 7.4.0 of SSCMS contains an SQL injection vulnerability. This vulnerability stems from improper handling of the tableHandWrite parameter in the SitesAddController.Submit.cs file of the DDL Handler...

SQL Injection

Craft CMS is vulnerable to SQL Injection. The vulnerability is due to missing input sanitization in the ElementSearchController::actionSearch endpoint, which allows an attacker to inject malicious SQL queries via parameters like criteriawhere or criteriaorderBy and extract sensitive database...

EUVD-2026-12173

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP implementation allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on the flight controller filesystem withou...

EUVD-2026-12152

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattucan contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattucan is enabled and running, a CAN-injection-capable...

CVE-2026-32707

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, tattucan contains an unbounded memcpy in its multi-frame assembly loop, allowing stack memory overwrite when crafted CAN frames are processed. In deployments where tattucan is enabled and running, a CAN-injection-capable...

MINI-MC35-4FH7-RC92

Bulletin has no description...

PT-2026-25389

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, The crsf rc parser accepts an oversized variable-length known packet and copies it into a fixed 64-byte global buffer without a bounds check. In deployments where crsf rc is enabled on a CRSF serial port, an...

PT-2026-25394

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, An unauthenticated path traversal vulnerability in the PX4 Autopilot MAVLink FTP implementation allows any MAVLink peer to read, write, create, delete, and rename arbitrary files on the flight controller filesystem withou...