PT-2026-104330

Name of the Vulnerable Software and Affected Versions Logback-classic versions 0.9.14 through 1.6.4 Description A path-traversal issue exists in the logback-classic module. An MDC-based discriminator value is passed unsanitized into a nested FileAppender path. An attacker who can influence this M...

Linux Distros Unpatched Vulnerability : CVE-2026-97876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while...

PT-2026-104328

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is...

NVIDIA Windows GPU Display Driver Kernel Module Multiple Vulnerabilities (September 2026)

The NVIDIA GPU display driver software on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following: - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper...

CVE-2026-102667

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-102667

The Joyland AI app is vulnerable to a JavaScript injection flaw in its WebView component, exploitable by an attacker with shared network access . The root cause allows unauthorized access to the clipboard , app-internal storage , and the ability to make arbitrary HTTP requests via the Weex 'strea...

EUVD-2026-91025

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-102667 Joyland AI WebView command injection

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-47599

A flaw was found in the NVIDIA GPU Display Driver open-source kernel module. An unprivileged local attacker can exploit improper preservation of memory access permissions during Direct Memory Access DMA mapping, which controls how the graphics hardware accesses system memory. Successful...

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

SummaryThe path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory, includi...

PYSEC-2026-4087 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

ImpactThe djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

PYSEC-2026-4038 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

django-oscar-moysklad (>=0.2.0, <=0.2.3), drf-paytm (0.0.1) +3 more potentially affected by CVE-2026-15307 via django (2.1.3)

django PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-oscar-moysklad =0.2.0, =1.4.3, =1.6.5 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

CVE-2026-103690

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

SUSE CVE-2026-97901

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...

CVE-2026-103690 itsourcecode Leave Management System controller.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

EUVD-2026-90888

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

GHSA-C48M-32M9-VX93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...