expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking

A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition,...

expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking

A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition,...

CVE-2026-86519

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

CVE-2026-86519

code-projects Student Crud Operation 1.0 is affected by an information disclosure vulnerability in its Backup File Handler component, specifically through the /card_activation.sql file. A remote, unauthenticated attacker can access this exposed database file, potentially revealing sensitive infor...

CVE-2026-86519 code-projects Student Crud Operation Backup File card_activation.sql information disclosure

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

CVE-2026-86519 code-projects Student Crud Operation Backup File card_activation.sql information disclosure

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

EUVD-2026-72642

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

CVE-2026-78620: External Control of File Name or Path

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-86804: Improper Authorization

A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to...

PT-2026-88432

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

PT-2026-88320

A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault unlock handler/vault recovery handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-78635: Improper Neutralization of Argument Delimiters in a Command

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

CVE-2026-86672: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. Th...

CVE-2026-73319: Improper Neutralization of Input During Web Page Generation

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to execute arbitrary JavaScript in the board origin by crafting a malicious javascript: URI that bypasses host validation. Attackers can embed the board hostna...

CVE-2026-73315: Server-Side Request Forgery (SSRF)

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

CVE-2026-73314: Improper Check for Unusual or Exceptional Conditions

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...

CVE-2026-86711: Exposed Dangerous Method or Function

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the...

PT-2026-86987

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public...

CVE-2026-86519: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

PT-2026-87096

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...