CVE-2026-75978 xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues...

PT-2026-78266

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...

PT-2026-78263

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE WGET TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. Th...

PT-2026-78836

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-755AP versions prior to 20260702 Description A command injection flaw exists in the ssi component within the /cgi-bin/email.cgi endpoint. The issue resides in the log email server function, allowing a remote attacker to execute...

PT-2026-78265

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description Remote SQL injection is possible through the manipulation of the ID argument in the '/admin/ajax.php?action=save menu' endpoint. SQL injection is a technique where an...

PT-2026-78260

Name of the Vulnerable Software and Affected Versions UTT HiPER 1200GW versions prior to 2.5.3-170306 Description A remote stack-based buffer overflow exists in the strcpy function within the /goform/formGroupConfig file. This issue occurs when the timestart argument is manipulated, potentially...

PT-2026-78719

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-70802

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-70804

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61755

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61753

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61324

Vulnerability in the Oracle Public Sector Financials International product of Oracle E-Business Suite component: Authorization. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2026-75876

EasyReport versions up to 2.0.17.0522_Beta contain a SQL injection in ModuleController.java via the sourcePath argument in the Move Operations component, exploitable remotely with low privileges; CVSS 6.3 (Medium) with proof-of-concept exploit disclosed; no patch version provided, project unrespo...

CVE-2026-75784 TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched...

EUVD-2026-60773

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched...

CVE-2026-75784

TRENDnet TEW-WLC100 (firmware 1v2.07b01) nginx HTTP Header Handler function FUN_0040da4c allows remote unauthenticated stack-based buffer overflow via the Server argument. CVSS 10.0 critical; proof-of-concept exploit is public at https://github.com/meishigana/CVE/blob/main/team15_20260702/02_wlc1...

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...