CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CVE-2026-55084

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

CVE-2026-55081

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2016-20096

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...

CVE-2026-55081

DHIS2 OpenAPI HTML endpoint is vulnerable to reflected XSS via the scope parameter. The OpenAPI UI renders crafted scope values without sufficient sanitization, enabling an attacker to execute JavaScript in a victim’s DHIS2-origin browser when a user opens the affected OpenAPI HTML URL. Affected ...

CVE-2026-55081

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

EUVD-2026-46360

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

CVE-2026-15829

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-16448

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...

CVE-2026-16448

The CVE-2026-16448 entry applies to D-Link DNS-series devices (e.g., DNS-120, DNS-320/325/327L, DNS-1550-04, etc.) up to 20260205. The affected element is function cgi_check_rsync_rw in /cgi-bin/remote_backup.cgi. Manipulating the ip argument results in a remote command injection, enabling remote...

CVE-2026-16447

CVE-2026-16447 concerns a vulnerability in the D-Link DNS-320 1.0.2 where the argument Filedata[] in /web/jquery/uploader/multi_uploadify.php can be manipulated to achieve unrestricted upload. Remote exploitation is possible according to the provided records. The affected component is a server-si...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

SUSE CVE-2026-64143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: uniwill-laptop: Do not enable the charging limit even when forced It seems that on some older models 2020 the battery charging limit can permanently damage the battery. Prevent users from enabling this feature thru...

CVE-2026-26199

A flaw was found in HDF5, a library used for managing large datasets. This vulnerability occurs when a specific function, H5Igetname, is called with an invalid size parameter, leading to a buffer underflow. An attacker could exploit this by providing specially crafted input, potentially causing t...

CVE-2026-64143

A flaw was found in the Linux kernel's Uniwill laptop driver. This vulnerability allows a local user to potentially cause permanent damage to the battery on certain older Uniwill laptop models. The issue arises when the battery charging limit feature is enabled through a 'force' module parameter,...

CVE-2026-16332

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...

CVE-2026-16334

The CVE-2026-16334 entry concerns itsourcecode Hospital Management System 1.0. A SQL injection vulnerability is present in an unknown code path of /prescriptionorder.php, triggered by manipulating the editid parameter. The issue is exploitable remotely, and publicly available exploit material exi...

CVE-2026-16330 D-Link DNS-320 uploadify.php unrestricted upload

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=fromcopylink causes unrestricted upload. Remote...