kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

EUVD-2026-77327

A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/productshandler.php of the component Product Management Module. Executing a manipulation of the argument ProductName can lead to cross site...

CVE-2026-90696

SourceCodester Inventory Management System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the Product Management Module , specifically in the file /api/products_handler.php . Manipulating the Product_Name argument allows a remote, low-privilege attacker to inject malicious scrip...

CVE-2026-90694 SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customershandler.php of the component Customer Management Module. Such manipulation of the argument CustomerName leads to cross site scripting. The attack can be...

EUVD-2026-77319

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customershandler.php of the component Customer Management Module. Such manipulation of the argument CustomerName leads to cross site scripting. The attack can be...

CVE-2026-90694 SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customershandler.php of the component Customer Management Module. Such manipulation of the argument CustomerName leads to cross site scripting. The attack can be...

cr-18-m4-service-exploitation

CR-18 / Module 4 — Service-Level Vulnerability Analysis & Expl...

CVE-2023-50460

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions userLogout, confirmUser, refuseUser, and resendUserConfirmation for any frontend user in the system...

CVE-2023-50460

CVE-2023-50460 is an authorization bypass in the femanager extension 7.x before 7.2.3 for TYPO3 . The backend module fails to properly restrict actions, allowing an authenticated backend user to perform userLogout, confirmUser, refuseUser, and resendUserConfirmation on any frontend user in the sy...

CVE-2026-82049: Improper Link Resolution Before File Access

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

PT-2026-91222

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or...

PT-2026-91223

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "alior product...

CVE-2026-49400: Deserialization of Untrusted Data

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

CVE-2026-90796: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-79701: Reliance on Untrusted Inputs in a Security Decision

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 5.6.1p2 and 6.0.0 - 6.9.0 - In the ajaxcontact, optinform and formbuilder addons, the result returned by the CAPTCHA plugin's...

PT-2026-91117

A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/products handler.php of the component Product Management Module. Executing a manipulation of the argument Product Name can lead to cross site...

PT-2026-91271

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

PT-2026-91166

Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Context in the Contact, Opt-in and Form Builder Addons in SP Page Builder Pro 3.2.6 - 6.9.0 - In the ajax contact, optin form and form builder addons, the result returned by the CAPTCHA plugin's onCheckAnswer event was...

CVE-2026-90694: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file /api/customershandler.php of the component Customer Management Module. Such manipulation of the argument CustomerName leads to cross site scripting. The attack can be...

CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...