CVE-2026-75090

Mistral.rs up to v0.8.22 has an out-of-bounds read in convert_gguf_to_hf_tokenizer (file: mistralrs-core/src/gguf/gguf_tokenizer.rs) triggered by crafted eos_token_id/bos_token_id/unknown_token_id arguments. The exploit is public (SSVC Exploitation: poc); upgrading to v0.8.23 (patch commit cd5297...

CVE-2026-75090

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

CVE-2026-75090 EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-75079

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /editsubject2.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made...

CVE-2026-75081

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

CVE-2026-75086

A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such manipulation of the argument delid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-75086

The itsourcecode Hospital Management System 1.0 is vulnerable to SQL injection via the delid argument in /viewroom.php, exploitable remotely with low privileges. CVSS 6.3 (Medium); a proof-of-concept exists, but no patch version or remediation is specified in the provided documents.

Linux Distros Unpatched Vulnerability : CVE-2026-53524

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate...

PT-2026-77485

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Calculation Manager version 11.2.25.0.000 Description A security flaw in the Oracle Hyperion Calculation Manager allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation ca...

PT-2026-77295

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN 00432574/FUN 0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer...

PT-2026-77134

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-WLC100 version 1v2.07b01 Description A stack-based buffer overflow exists in the HTTP Header Handler component within the /usr/nginx/sbin/nginx file. The issue occurs in the FUN 0040da4c function when the Server argument is...

CVE-2021-43718

CVE-2021-43718 is an authentication bypass in the Web Control interface of the Epson EH-TW5350 projector (firmware 150075647YWWV110 ). A remote, unauthenticated attacker can send a specially crafted series of HTTP requests to cause a Denial of Service . The vulnerability was discovered by team B-...

Linux Distros Unpatched Vulnerability : CVE-2026-75003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which m...

PT-2026-78251

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan l2tp password causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been...

CVE-2026-75077

SourceCodester Class and Exam Timetabling System 1.0 has a reflected cross-site scripting (XSS) flaw in BSCE2.php, where the "course" argument is rendered without sanitization, allowing unauthenticated remote attackers to inject scripts; CVSS 4.3 (Medium) scores it as network-accessible with low ...

CVE-2026-75013

A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146B20201023. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation results in null pointer dereference. The attack can be launched remotely. The exploit is now public and may be used...

EUVD-2026-60439

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-75013

The affected device is the TOTOLINK EX1200L router (firmware 9.3.5u.6146_B20201023). The setWizardCfg function in /cgi-bin/cstecgi.cgi lacks a null check, causing a crash when a crafted request dereferences a null pointer remotely. A public proof-of-concept exploit exists; impact is denial of ser...

CVE-2026-75011

A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The proje...