163494 matches found
PT-2026-102999
A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely...
PT-2026-102979
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument...
PT-2026-103000
A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function child process.exec of the file src/github.ts of the component Git Remove MCP Tool. Such manipulation of the argument File leads to os command injection. The...
PT-2026-103269
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...
PT-2026-103496
restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...
PT-2026-103577
Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description A resource exhaustion issue allows an unauthenticated remote attacker to repeatedly trigger a costly server-side operation, resulting in a partial denial of service...
PT-2026-103282
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is...
PT-2026-103331
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection...
PT-2026-103456
A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID leads to authorization bypass. The attac...
CVE-2026-102842: Unrestricted Upload of File with Dangerous Type
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...
CVE-2026-102909: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/examproper/btnfunctions.php. The manipulation of the argument accesscode leads to sql injection. The attack can be initiated remotely...
CVE-2026-102844: Authorization Bypass Through User-Controlled Key
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporandatapasien.php. Executing a manipulation of the argument idparam can lead to...
CVE-2026-103222: Integer Overflow or Wraparound
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclzdecompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is...
PT-2026-103131
Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 Description An authentication bypass exists in the DOM security processor. This allows unauthenticated remote attackers to forge...
VulnCheck KEV: CVE-2024-58387
Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...
VulnCheck KEV: CVE-2026-76504
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request...
CVE-2026-102454: Unrestricted Upload of File with Dangerous Type
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
PT-2026-103272
Name of the Vulnerable Software and Affected Versions GraphicsMagick versions prior to 1.3.48 Description The WPG File Handler component contains a flaw in the ExtractPostscript function within the coders/wpg.c file. A remote attacker can trigger uncontrolled recursion through specific...
PT-2026-103009
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer 0/admins/assessments/examproper/btn functions.php. The manipulation of the argument access code leads to sql injection. The attack can be initiated remotel...
PT-2026-103457
Name of the Vulnerable Software and Affected Versions vllm-project vLLM versions prior to 0.29.1rc0 Description A flaw in the Gemma4UnifiedParser component, specifically within the file rust/src/parser/src/unified/gemma4.rs, allows a remote attacker to cause a denial of service through specific...