CVE-2026-90509 dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

CVE-2026-90508 Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization

A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in the library ProtectFilter64.sys of the component Message Dispatch Handler. Performing a manipulation results in missing authorization...

EUVD-2026-76972

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

EUVD-2026-76973

A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...

EUVD-2026-76971

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This affects the function HrInfoController.updatePass of the file /hr/pass of the component Password Update Handler. The manipulation of the argument hrid results in improper authorization. The attack can be executed remotely. The...

EUVD-2026-76976

A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub11008 in the library ComputerZx64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploi...

EUVD-2026-76975

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The...

EUVD-2026-76974

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...

CVE-2026-90507 vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

CVE-2026-90507 vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access control

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function getsurgesubscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

Exploit for SQL Injection in Apache Superset

CVE-2026...

CVE-2026-90503

A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub11008 in the library ComputerZx64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploi...

CVE-2026-90502

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2026-90506 vvbbnn00 WARP-Clash-API Save Account Job race condition

A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. Th...

CVE-2026-90506 vvbbnn00 WARP-Clash-API Save Account Job race condition

A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. Th...

CVE-2026-90505 vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is...

CVE-2026-90505 vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is...

CVE-2026-90504 vvbbnn00 WARP-Clash-API authorized missing authentication

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclos...

CVE-2026-90504 vvbbnn00 WARP-Clash-API authorized missing authentication

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRETKEY leads to missing authentication. The attack can be initiated remotely. The exploit has been disclos...

CVE-2026-90503

Chengdu Qilu Technology Ludashi version 6.1026.4715.714 contains an information disclosure vulnerability in the function sub_11008 within the driver ComputerZ_x64.sys . The flaw is triggered by manipulating the PhysicalAddress argument, allowing a local attacker with high privileges to read sensi...