CVE-2026-78863

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfatoken Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...

CVE-2026-78656

itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/cust_del.php, triggered by manipulation of the ID argument. The flaw can be exploited remotely with low privileges required (authenticated user) and no user interaction, yielding low impact...

EUVD-2026-65305

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custdel.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

CVE-2026-78637

CVE-2026-78637 is an argument injection vulnerability in Fdawgs node-poppler (versions up to 9.1.2/10.0.1 ), a Node.js wrapper for the Poppler PDF library. The flaw resides in the Argument Injection Handler within src/index.js, affecting multiple PDF conversion and manipulation functions includin...

EUVD-2026-65293

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption,...

EUVD-2026-65177

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435

A path traversal vulnerability exists in Faveo Helpdesk up to version 2.0.3 . The flaw is in the unlink function within app/Http/Controllers/Admin/helpdesk/SettingsController.php (component: Logo Handler ). Manipulation of the data1 argument allows an authenticated attacker (high privileges requi...

CVE-2026-78434

Faveo Helpdesk versions up to 2.0.3 contain a missing authentication flaw in the FormController::post_ticket_reply function within app/Http/Controllers/Client/helpdesk/FormController.php, specifically in the post-ticket-reply Endpoint . An unauthenticated remote attacker can exploit this to achie...

CVE-2026-71914

Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...

CVE-2026-71936

Multiple DrayTek VigorSwitch models contain a buffer overflow in the sysreboot function, caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker with valid administrative credentials on the device's web management interface can trigger the flaw via crafted ...

EUVD-2026-64992

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

CVE-2026-78250

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This...

CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-74692

A flaw was found in the Linux kernel's net/smc component. A time-of-check to time-of-use TOCTOU race condition allows a remote attacker to exploit a window where the listener's state is checked without proper locking. By opening TCP connections while the server is closing, an attacker can cause a...

CVE-2026-78247

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirmorder. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has be...

CVE-2026-78250

bytebot-ai bytebot 0.0.1 is affected by a vulnerability in the Agent Execution Workflow component where manipulation of an unknown function leads to an infinite loop , resulting in a denial of service (availability impact only). The attack can be performed remotely and requires low privileges (CV...

EUVD-2026-64854

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component Agent Execution Workflow. Such manipulation leads to infinite loop. The attack may be performed from remote. The exploit is publicly available and might be used. This...

CVE-2026-78248

A SQL injection vulnerability exists in SourceCodester Simple Online Food Ordering System 1.0 , in the file /fos/admin/ajax.php?action=save_settings. The Name argument is susceptible to manipulation, allowing a remote, unauthenticated attacker to inject SQL commands. The exploit has been publicly...

CVE-2026-78245

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function moveuploadedfile of the file allusers/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. T...