CVE-2026-86296

D-Link DIR-822A (firmware A_101) is affected by a stack-based buffer overflow in the udhcpcd component, specifically in the strcpy call within serverpacket.c. The overflow is triggered during parsing of TR-111 Option 125 in DHCPv6 messages. The vulnerability is exploitable remotely without authen...

CVE-2026-86285

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...

EUVD-2026-72306

A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public...

CVE-2026-86289

Ollama up to 0.31.1 contains an integer overflow in the function readGGUFV1String within the file fs/ggml/gguf.go, part of the GGUF Decoder component. The vulnerability is remotely exploitable with user interaction required and no authentication needed, leading to a low availability impact (CVSS ...

CVE-2026-86285

BookStack versions up to 26.05.2 are affected by an improper access control vulnerability in the Attachment Edit Endpoint , specifically the AttachmentController::getUpdateForm function in app/Uploads/Controllers/AttachmentController.php. The ID argument can be manipulated to bypass permission ch...

CVE-2026-86240

liufee FeehiCMS up to version 2.1.1 contains a server-side request forgery (SSRF) vulnerability in the catchImage function of the file backend/widgets/ueditor/Uploader.php (UEditor component). Manipulation of the source[] argument enables remote attackers to forge server-side requests. A proof-of...

CVE-2026-86237

A server-side request forgery (SSRF) vulnerability affects the openagents-org/openagents Python SDK in versions up to 0.8.19 / 0.9.3.post20 . The vulnerable function is test_default_model in sdk/src/openagents/sdk/transports/http.py, where an unvalidated base_url argument allows a remote, unauthe...

PT-2026-86667

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. Th...

EUVD-2026-72138

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hoteldb%201.sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is...

CVE-2026-86172

CVE-2026-86172 is an SQL injection vulnerability in DefaultFuction CRM version 1.0.0 , located in the file /modules/customers/delete.php . An attacker can manipulate the ID argument to inject SQL commands, enabling remote exploitation with low privileges required and no user interaction. The CVSS...

CVE-2026-86170 DefaultFuction CRM edit.php sql injection

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the...

CVE-2026-86166

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit h...

Linux Distros Unpatched Vulnerability : CVE-2026-85522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file...

CVE-2026-85639 jofpin trape Telemetry Endpoint user.py race condition

A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown code of the file core/user.py of the component Telemetry Endpoint. Such manipulation of the argument vId leads to race condition. The attack can be executed remotely. Attacks of this nature are high...

CVE-2026-85398

code-projects Hospital Information System 1.0 contains a SQL injection vulnerability in the viewReq function of the file viewReq.php , triggered by manipulating the ID argument. The attack can be launched remotely without authentication. The CVSS 3.1 base score is 7.3 (HIGH) with low impacts on c...

CVE-2026-85379

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects the function ChapterModel::searchChapter of the file App/Home/Controller/ChapterController.class.php of the component Query Builder. The manipulatio...

The vulnerability of the vti6_tnl_lookup() function in the net/ipv6/ip6_vti.c module of the IPv6 protocol implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vti6tnllookup function in the net/ipv6/ip6vti.c module of the IPv6 protocol implementation in the Linux operating system is related to incorrect checking of the unsafe equivalence of input data. Exploiting this vulnerability may allow an attacker, acting remotely, to...

PT-2026-86221

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and...

CVE-2026-85137 SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacmslocoynews.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed...

CVE-2026-85040

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...