Metabase Authentication Bypass / SQL Injection

Metabase versions x.58.0 through x.63.4 contain an unauthenticated SQL injection vulnerability in the password reset functionality that can allow a remote attacker to manipulate database queries and obtain administrator access. This proof of concept exploits the vulnerable password reset endpoint...

CVE-2026-65822: Improper Neutralization of Special Elements used in an SQL Command

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-19996: Improper Privilege Management

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

CVE-2026-13202: Improper Neutralization of Input During Web Page Generation

A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue affects Opentext Directory Services: through 22.2...

VulnCheck KEV: CVE-2025-52907

Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This issue affects X6000R: through V9.4.0cu.1360B20241207...

PT-2026-76673

Name of the Vulnerable Software and Affected Versions Opentext Directory Services versions prior to 22.2 Description An issue in the OTDS Swagger UI allows for input data manipulation via HTML injection, which occurs when an application fails to properly sanitize user-supplied input before...

PT-2026-73217

A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed...

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

The vulnerability of the jdi_panel_dsi_remove() function in the drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c driver is a flaw in the Linux kernel’s Direct Rendering Infrastructure (DRI) subsystem. This vulnerability allows an attacker to cause a service failure.

The vulnerability of the jdipaneldsiremove function in the drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c driver of the Direct Rendering Infrastructure DRI kernel of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability can allow a remote attacker to cause a...

The vulnerability of the amdgpu_device_ip_init() function in the drivers/gpu/drm/amd/amdgpu/amdgpu_device.c source file of the Direct Rendering Infrastructure (DRI) driver for AMD GPU cores in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the amdgpudeviceipinit function in the drivers/gpu/drm/amd/amdgpu/amdgpudevice.c source file of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an...

The vulnerability of the nvmet_biodone() function in the drivers/nvme/target/io-cmd-bdev.c file of the NVME kernel of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the nvmetbiodone function in the drivers/nvme/target/io-cmd-bdev.c file of the NVME kernel in the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the remove() function in the driver/gpu/drm/amd/amdgpu/amdgpu_gmc.c file of the Direct Rendering Infrastructure (DRI) AMD GPU kernel for the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the remove function in the driver/gpu/drm/amd/amdgpu/amdgpugmc.c file of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service...

The vulnerability of the __req_mod() function in the drivers/block/drbd/drbd_req.c module of the Linux kernel’s block device driver allows a attacker to cause a service failure.

The vulnerability of the reqmod function in the drivers/block/drbd/drbdreq.c file of the Linux kernel’s block device driver involves pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the trigger_kthread_fn() function in the kernel/trace/traceeventstrigger.c module, which supports kernel tracing in Linux operating systems, allows a hacker to cause a service failure.

The vulnerability of the triggerkthreadfn function in the kernel/trace/traceeventstrigger.c module, which supports kernel tracing in Linux operating systems, relates to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-16742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user CVE-2026-16742 Note that...

The vulnerability of the functions mlx5e_tc_del_fdb_peer_flow() and mlx5e_tc_clean_fdb_peer_flows() in the driver module drivers/net/ethernet/mellanox/mlx5/core/en_tc.c of the Mellanox Ethernet network adapter driver for the Linux operating system, which allows a hacker to cause a service failure.

The vulnerability of the functions mlx5etcdelfdbpeerflow and mlx5etccleanfdbpeerflows in the driver module drivers/net/ethernet/mellanox/mlx5/core/entc.c of the Mellanox Ethernet network adapter driver for the Linux operating system is related to pointer manipulation. Exploiting this vulnerabilit...

PT-2026-76692

Name of the Vulnerable Software and Affected Versions New API versions prior to 1.0.0-rc.18 Description An issue exists where user-controlled quantity parameters can cause overflow conversions during quota calculations in common/quota math.go and related settlement paths. A low-privileged account...

LightRAG <= 1.5.4 - Missing Authentication

LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access. id:...

CVE-2026-19725

The WPvivid — Backup, Migration & Staging WordPress plugin versions before 0.9.131 is vulnerable to an unauthenticated path traversal via the send_to_site_connect functionality. The root cause is a failure to sanitize values from an unauthenticated request used to construct a log file path. An at...