226050 matches found
CVE-2026-77683 Comfast CF-N1-S mbox-config system command injection
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntptimezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit ha...
EUVD-2026-63876
A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...
CVE-2026-77681
CodeAstro Online Job Portal 1.0 is affected by an unrestricted file upload vulnerability in the file /users/update-profile.php. Manipulation of the Name argument allows a remote, authenticated attacker (low privileges) to upload arbitrary files, leading to low impact on confidentiality, integrity...
cveye
C V E y e Zero-dependency CLI for CVE details & expl...
CVE-2026-74517
A flaw was found in KVM Kernel-based Virtual Machine. This vulnerability occurs when the system attempts to process a delayed I/O APIC End-of-Interrupt EOI after the associated virtual CPUs vCPUs have been destroyed. This timing issue results in a Use-After-Free UAF condition, where the system...
CVE-2026-74467
A flaw was found in the s390/qeth component of the Linux kernel. An unprivileged local user could exploit this vulnerability by invoking specific SIOCDEVPRIVATE ioctl commands, such as SIOCQETHADPSETSNMPCONTROL, SIOCQETHGETCARDTYPE, and SIOCQETHQUERYOAT. These commands were not properly restricte...
CVE-2026-77391
A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...
CVE-2026-76137
Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe...
EUVD-2026-63793
A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...
CVE-2026-77392 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection
A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...
CVE-2026-77392
The "Researcher" argument in the saveUser function of /public/submit.php (SourceCodester Dynamic Input Field Generator v1.0) is passed unsanitized to SQL queries, enabling remote SQL injection. CVSS 6.3 (MEDIUM). A public PoC exploit exists at https://gist.github.com/rionyxraiza/6b22a5e02da6b8581...
EUVD-2026-63796
A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...
CVE-2026-77391
SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 is vulnerable to cross-site request forgery (CSRF) via an unidentified function. CVSS 4.0 scores it MEDIUM (5.3); the attack is remote, requires no privileges and passive user interaction, with integrity impact. A proof-of-...
CVE-2026-77391 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery
A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...
CVE-2026-77650
The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...
PT-2026-79351
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntp timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit h...
CVE-2026-77647
SPIP before 4.4.20 is vulnerable to unauthenticated remote code execution (CVSS 9.8, CRITICAL). The root cause is an incorrect identification of <?php blocks combined with var_export's mishandling of certain cases involving a
CVE-2026-19449
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a vulnerability in cmdnim that may allow an unprivileged local user to executes the payload as root...