CVE-2026-28542

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-28542

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-28542

A CVE entry for CVE-2026-28542 describes a permission bypass in the system service framework. The vulnerability is local (attack vector: LOCAL) with low attack complexity and no required privileges, and it could affect availability (C: High, I: Low, A: Low) per CVSS v3.1 (score 7.3, HIGH). The de...

SUSE CVE-2025-66630

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may...

EUVD-2026-9775

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Veil veil allows PHP Local File Inclusion.This issue affects Veil: from n/a through = 1.9...

EUVD-2026-9702

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Grit grit allows PHP Local File Inclusion.This issue affects Grit: from n/a through = 1.0.1...

EUVD-2026-9589

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes FindAll findall allows PHP Local File Inclusion.This issue affects FindAll: from n/a through = 1.4...

CRLF Injection

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to CRLF Injection via the writeSSE function when untrusted input containing carriage return or newline characters is passed to the event, id, or retry fields. An attacker can inject addition...

CRLF Injection

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to CRLF Injection via the setCookie utility. An attacker can inject unauthorized cookie attributes by supplying specially crafted input containing semicolons, carriage returns, or newline...

CVE-2026-27971

Qwik is a performance focused javascript framework. qwik =1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where...

Duplicate Advisory: Cache poisoning via insecure-by-default cache key

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f93w-pcj3-rggc. This link is maintained to preserve external references. Original Description A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction...

GHSA-2M8C-2374-465F Duplicate Advisory: Cache poisoning via insecure-by-default cache key

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f93w-pcj3-rggc. This link is maintained to preserve external references. Original Description A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction...

PT-2026-23305

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Nuts nuts allows PHP Local File Inclusion.This issue affects Nuts: from n/a through = 1.10...

PT-2026-23428

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-23508

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 15.98.0 Frappe versions prior to 14.100.0 Description Frappe is a full-stack web application framework. A flaw exists due to insufficient validation during document sharing, potentially allowing a user to share a...

PT-2026-23509

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 14.100.1 Frappe versions prior to 15.100.0 Description Frappe, a full-stack web application framework, had an endpoint susceptible to SQL injection. Specifically, crafted requests could exploit this weakness, potential...

PT-2026-23507

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.11.0 and 15.102.0 Description A flaw exists in Frappe that allows an attacker to inject malicious code through a crafted image URL. This can lead to Cross-Site Scripting XSS when a user’s avatar is displayed. The...

Allauth-Django input validation vulnerability

allauth-django is an open-source authentication application developed by allauth. Versions of allauth-django prior to 65.14.1 contained a vulnerability related to input validation errors. This vulnerability stemmed from an open redirection issue when SAML-based IdPs enabled SSO, allowing attacker...

Huawei EMUI and Huawei HarmonyOS security vulnerabilities

Huawei EMUI is a mobile operating system developed based on Android.Huawei HarmonyOS is an operating system. Provides a full-scene distributed operating system based on a microkernel. A privilege bypass vulnerability exists in the Huawei EMUI and Huawei HarmonyOS system service framework, which c...

Frappe cross-site scripting vulnerability

Frappe is a web development framework based on Python and Mariadb, with integrated front-end pages, developed by the Indian company Frappe. Versions of Frappe prior to 16.11.0 and 15.102.0 contained a cross-site scripting vulnerability. This vulnerability occurred due to the possibility of...