EUVD-2026-87157

A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument userid/companyid causes use of hard-coded password. The attack is...

CVE-2026-97877 zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password

A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument userid/companyid causes use of hard-coded password. The attack is...

CVE-2026-97877

The zhistaredu StarTraining software, up to version 3.8.1 , is vulnerable to a remote attack affecting the JWT Token Handler component. Specifically, a flaw in the UserLoginService.createToken function within the application.yml file allows for the manipulation of user_id or company_id arguments....

CVE-2026-67225 RabbitMQ: Stream-protocol frame length never validated against frame_max

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

CVE-2026-97871 Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The...

CVE-2026-97871 Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The...

CVE-2026-97871

A code injection vulnerability exists in Zhonglun CloudPos versions up to 3.0.1.76 . The flaw resides in the OpenLocalBrowser function within the ZlPos/ZlPos/Bizlogic/JSBridge.cs file of the JSBridge component. An attacker can exploit this by manipulating the url argument to execute code remotely...

CVE-2026-79064

A flaw was found in the Network component of Google Chrome. A remote attacker, by leveraging social engineering tactics and a specially crafted Chrome extension, could exploit a use-after-free vulnerability. This could lead to the execution of arbitrary code outside of the browser's security...

CVE-2026-79210

A flaw was found in the Audio component of Chromium, specifically in Google Chrome on Android. This use-after-free vulnerability allows a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to...

CVE-2026-97866

A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint...

EUVD-2026-87114

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

CVE-2026-97869

A deserialization vulnerability exists in langchain4j affecting versions up to 1.5.3-beta10, 1.11.10-beta18, and 1.18.1-beta27. The flaw is located in the AgenticScopeSerializer.fromJson function within the AgenticScopeJsonSerializationIT.java file of the LangChain4j-agentic component. Remote exp...

CVE-2026-97869 langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

CVE-2026-97869 langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

EUVD-2026-87113

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

CVE-2026-97868

The software sheshbabu zen (up to version 1.5.0 ) is vulnerable to a cross-site scripting (XSS) vulnerability. The root cause is the use of the dangerouslySetInnerHTML function within the features/notes/NotesEditor.jsx file of the Note Editor component. This flaw allows for remote initiation of a...

CVE-2026-97868 sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

CVE-2026-97868 sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

CVE-2026-97866

A weakness exists in Zhonglun CloudPOS 3.0 within the Automatic Update component, specifically involving an unknown functionality in the Program.cs file. By manipulating arguments such as version , url , packagekey , or package name , a remote attacker can cause a channel to become accessible by ...

CVE-2026-97866 Zhonglun CloudPOS Automatic Update Program.cs channel accessible

A weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint...