CVE-2026-4841

A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shopping Cart Module. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit h...

CVE-2026-4844

A vulnerability was detected in code-projects Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin.php of the component Admin Login Module. The manipulation of the argument Username results in sql injection. The attack may be performed from remote. The...

CVE-2026-4908

The CVE-2026-4908 entry concerns code-projects Simple Laundry System 1.0. The vulnerability resides in the Parameter Handler’s modstaffinfo.php, where manipulating the userid parameter enables SQL injection. The flaw is exploitable remotely and has seen public exploit activity. Connected sources ...

[SECURITY] Fedora 43 Update: libopenmpt-0.8.6-1.fc43

libopenmpt is a cross-platform C++ and C library to decode tracked music files modules into a raw PCM audio stream. libopenmpt is based on the player code of the OpenMPT project Open ModPlug Tracker. In order to avoid code base fragmentation, libopenmpt is developed in the same source code...

CVE-2026-30302

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

The vulnerability of the j1939_session_activate() function in the net/can/j1939/transport.c module allows attackers to compromise the confidentiality, integrity, and accessibility of protected information when working with j1939 CAN interfaces in Linux operating systems.

The vulnerability of the j1939sessionactivate function in the net/can/j1939/transport.c module, which handles J1939 sockets for CAN interfaces in Linux operating systems, is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

The vulnerability of the adm_slave_config() function in the drivers/dma/qcom/qcom_adm.c module of the DMA driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the admslaveconfig function in the drivers/dma/qcom/qcomadm.c module of the DMA driver for the Linux operating system is related to incorrect comparison operations. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

QDocs Smart School Management System 代码注入漏洞

QDocs Smart School Management System is a smart community-building system developed by QDocs Corporation. Versions of the QDOCS Smart School Management System prior to 7.2 contained a code injection vulnerability. This vulnerability stemmed from incorrect handling of parameters in the...

CVE-2026-30574

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if the requested sales quantity txtqty exceeds the available stock level. An attacker can manipulate the request to purchase a quantity that is...

The vulnerability of the c4iw_fill_res_cm_id_entry() function in the drivers/infiniband/hw/cxgb4/restrack.c module of the Linux operating system’s kernel, which allows a hacker to trigger a service failure.

The vulnerability of the c4iwfillrescmidentry function in the drivers/infiniband/hw/cxgb4/restrack.c module of the Linux operating system’s kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the blkcg_init_disk() function in the block/blk-cgroup.c module, which supports the Linux kernel’s block-level support, allows a attacker to cause a service failure.

The vulnerability of the blkcginitdisk function in the block/blk-cgroup.c module, which supports the Linux kernel’s block-level support, involves the failure to release resources after their useful life has expired. Exploiting this vulnerability could allow an attacker to cause service failures...

OTCMS 安全漏洞

OTCMS is a content management system CMS for article-based websites developed by OTCMS Inc. Versions of OTCMS prior to V7.66 contained security vulnerabilities. These vulnerabilities stemmed from server-side request forgeing in the AnnounContent module of the admin/read.php file. This vulnerabili...

CVE-2026-23397

A flaw was found in the nfnetlinkosf module of the Linux kernel. A remote attacker could send specially crafted network packets containing malformed options, such as zero-length options or a Maximum Segment Size MSS option with an invalid length. This could lead to a system crash, resulting in a...

CVE-2026-33913

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing to read arbitrary files from the server. Version 8.0.0....

Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Summary A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions inside export declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content...

GHSA-6Q6H-J7HJ-3R64 Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code

Summary A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution RCE by injecting arbitrary JavaScript expressions inside export declarations in ES module scripts processed by happy-dom. The compiler directly interpolates unsanitized content...

CVE-2026-4933

A flaw was found in Drupal's Unpublished Node Permissions module. This incorrect authorization vulnerability allows an attacker to bypass intended access controls, potentially enabling them to view unpublished content through forceful browsing...

CVE-2026-3525

A flaw was found in Drupal File Access Fix deprecated. An incorrect authorization vulnerability allows an attacker to perform forceful browsing, potentially leading to unauthorized access to sensitive information or resources. This issue arises due to improper checks on file access permissions...

CVE-2026-0748 Access bypass in Drupal 7 i18n_node translation UI

In the Drupal 7 Internationalization i18n module, the i18nnode submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls an...

CVE-2026-3573 AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

Incorrect Authorization vulnerability in Drupal AI Artificial Intelligence allows Resource Injection.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12...