PT-2026-81892

Name of the Vulnerable Software and Affected Versions code-projects Simple Inventory System version 1.0 Description An issue exists in the /InventoryManagement/edit.php endpoint where the manipulation of the ID argument allows for SQL injection. This allows a remote attacker to interfere with the...

CVE-2026-78430 sworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection

A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component Tool Handler. The manipulation of the argument format results in os command injection. Attacking locally is a requirement. The...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Summary Langflow OSS supports custom Python components and validation of component code for component development workflows. Weaknesses in custom component execution paths, validation endpoints, and trusted template enforcement could allow authenticated users to execute arbitrary Python code or...

CVE-2026-78250

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This...

CVE-2026-78250 bytebot-ai bytebot Agent Execution Workflow infinite loop

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This...

CVE-2026-78250

bytebot-ai bytebot 0.0.1 is affected by a vulnerability in the Agent Execution Workflow component where manipulation of an unknown function leads to an infinite loop , resulting in a denial of service (availability impact only). The attack can be performed remotely and requires low privileges (CV...

CVE-2026-78247 SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirmorder. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has be...

CVE-2026-78244

A SQL injection vulnerability exists in itsourcecode Real Estate Management System 1.0 , specifically in the file search.php . Manipulating the arguments search, delivery_type, search_price, or property_type allows an unauthenticated remote attacker to inject SQL, with no user interaction require...

EUVD-2026-64777

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/deliverytype/searchprice/propertytype results in sql injection. The attack may be initiated...

Astra Linux – Vulnerability in Firefox

The NSCDeriveKey function inadvertently assumed that the phKey parameter was always non-NULL. When the parameter was passed as NULL, a segmentation fault occurred, resulting in crashes. This behavior conflicts with the PKCS11 v3.0 specification, which allows phKey to be NULL for certain mechanism...

Astra Linux – Vulnerability in python-cryptography

A flaw was discovered in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which could result in the exposure of confidential or sensitive data...

Astra Linux – Vulnerability in opensc

A vulnerability was discovered in OpenSC, OpenSC tools, the PKCS11 module, minidrivers, and CTK. The issue arises from the lack of initialization of variables that should be initialized as arguments to other functions, etc...

Astra Linux – Vulnerability in curl

This flaw allows a malicious HTTP server to set “super cookies” using curl, which are then transmitted back to multiple origins beyond what is allowed or possible. This enables a site to set cookies that are then sent to different and unrelated sites and domains. The attack exploits a flaw in...

Astra Linux – Vulnerability in opensc

A vulnerability was discovered in OpenSC, OpenSC tools, the PKCS11 module, minidrivers, and CTKs. An attacker could use a specially crafted USB device or smart card, causing the system to send a specially crafted response to APDUs. The following issues were caused by insufficient control over the...

Astra Linux – Vulnerability in Firefox

We are aware that the exploit code for this vulnerability is publicly available. However, we have no knowledge of any attacks in the wild that exploit this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: dmaengine: Fixed an issue where the clientcount variable was incremented twice for public channels when dmachanget was called for a channel. This occurred first in balancerefcount, and again before returning. As a result, the...

Astra Linux - Vulnerability in Golang-1.19

Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/TLS clients, as well as servers that have Config.ClientAuth set to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default...

CVE-2026-78202

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function savesettings of the file adminclass.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used...

CVE-2026-78201

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file adminclass.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the publ...

CVE-2026-78199

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/viewprod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and...