PT-2026-103269

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The...

PT-2026-103496

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

PT-2026-103577

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description A resource exhaustion issue allows an unauthenticated remote attacker to repeatedly trigger a costly server-side operation, resulting in a partial denial of service...

PT-2026-103331

A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection...

PT-2026-103456

A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID leads to authorization bypass. The attac...

CVE-2026-102842: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function appuserloginmodel.php::cekUserLogin of the file application/models/appuserloginmodel.php of the component KCFinder File Manager. Such manipulatio...

CVE-2026-102909: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer0/admins/assessments/examproper/btnfunctions.php. The manipulation of the argument accesscode leads to sql injection. The attack can be initiated remotely...

CVE-2026-102844: Authorization Bypass Through User-Controlled Key

A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporandatapasien.php. Executing a manipulation of the argument idparam can lead to...

CVE-2026-103222: Integer Overflow or Wraparound

A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclzdecompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is...

PT-2026-103131

Name of the Vulnerable Software and Affected Versions Apache WSS4J versions prior to 4.0.2 Apache WSS4J versions prior to 3.0.6 Apache WSS4J versions prior to 2.4.4 Description An authentication bypass exists in the DOM security processor. This allows unauthenticated remote attackers to forge...

CVE-2026-102454: Unrestricted Upload of File with Dangerous Type

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

PT-2026-103009

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer 0/admins/assessments/examproper/btn functions.php. The manipulation of the argument access code leads to sql injection. The attack can be initiated remotel...

PT-2026-103457

Name of the Vulnerable Software and Affected Versions vllm-project vLLM versions prior to 0.29.1rc0 Description A flaw in the Gemma4UnifiedParser component, specifically within the file rust/src/parser/src/unified/gemma4.rs, allows a remote attacker to cause a denial of service through specific...

CVE-2026-103241: Improper Resource Shutdown or Release

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has bee...

PT-2026-103529

Name of the Vulnerable Software and Affected Versions Kiteworks Secure Data Forms versions prior to 9.5.0 Description An issue exists that allows an unauthenticated remote attacker to perform Server-Side Request Forgery SSRF, a technique where the attacker induces the server to make requests to a...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789786148)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789786148 advisory. - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-good / gstreamer1-plugins-good-gtk / etc (ALMALINUX9.6:CLSA-2026:1786699059)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786699059 advisory. - A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a...

PT-2026-102995

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes...

CVE-2026-88920: Improper Authentication

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...

CVE-2026-51864: Improper Limitation of a Pathname to a Restricted Directory

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in pythonfileupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/pythonuploadapi.py:42. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...