CVE-2026-108779 erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection

A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be...

EUVD-2026-97134

A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be...

CVE-2026-108779

A SQL injection vulnerability exists in erzhongxmu JEEWMS (versions up to 2026.09.27-W39). The flaw is located in the WmSttInGoodsController.list function within the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Specifically, improper handling of the searchstr argument a...

Amazon Linux 2 : rpm (ALAS-2026-3984)

The version of rpm installed on the remote host is prior to 4.11.3-48. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3984 advisory. A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lea...

Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

CVE-2026-109357: Improper Neutralization of Special Elements used in an LDAP Query

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

Moderate: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924 curl: curl: Information disclosure...

Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution RCE, server-side template injection SSTI, stored...

PT-2026-110625

Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.1.2 Thelia versions 3.2.x prior to 3.2.1 Description An issue exists where unauthenticated visitors can perform CSV formula injection by providing specially crafted data in registration, checkout, or newsletter field...

PT-2026-110641

Name of the Vulnerable Software and Affected Versions MarkLogic Server versions 11.0.0 through 11.3.6 MarkLogic Server versions 12.0.0 through 12.0.9 Description An XQuery injection flaw exists in a deprecated Management API package path. A remote attacker with manage-user-level privileges can...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2026-4295)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context...

ALSA-2026:80664 Moderate: environment-modules security update

The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "modul...

ALSA-2026:80507 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-772...

PT-2026-110858

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Remote command injection is possible due to improper processing of the /goform/formAutoFWupgrade endpoint. An attacker can execute arbitrary commands by manipulating the tftpsIP argument. Recommendatio...

PT-2026-110997

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

PT-2026-110868

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Command injection is possible via remote manipulation of the readE2P argument within a function in the /goform/formWlanMP endpoint. This issue affects products that are no longer supported by the...

PT-2026-110725

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.6 Craft CMS versions 5.0.0 through 5.10.13 Description Authenticated control panel users with the performUpdates permission or Updates-utility access can execute arbitrary code. The issue occurs because th...

CVE-2026-108918: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4211)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...