CVE-2026-93955: Authorization Bypass Through User-Controlled Key

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argumen...

CVE-2026-93738

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made publ...

CVE-2026-93739 Totolink A3002MU formWlAc buffer overflow

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed...

CVE-2026-93738 Totolink A3002MU formSchedule buffer overflow

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made publ...

CVE-2026-93738 Totolink A3002MU formSchedule buffer overflow

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made publ...

CVE-2026-93738

A buffer overflow vulnerability in Totolink A3002MU (firmware Hh-B20211125.1046) affects the formSchedule function within /boafrm/formSchedule. Manipulating the webpage argument triggers the overflow, enabling a remote attack with low complexity. The CVSS 3.1 score is 9.9 (CRITICAL) with scope ch...

CVE-2026-84241

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization...

CVE-2026-84085

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-84082

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-17619

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

EUVD-2026-83300

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

CVE-2026-75878 IBM Sterling File Gateway is Vulnerable to Authentication Bypass

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

CVE-2019-25776 Weaver E-cology SQL Injection via SyncUserInfo.jsp

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping...

CVE-2026-93534

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...

SUSE CVE-2026-93379

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-93380

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-55556 Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

CVE-2026-93559 Forget-C Jellyfish AI Short Drama Studio FastAPI dependencies.py missing authentication

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...

CVE-2026-91149

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the "cockpit-tls" service. This forces the service to create an unbounded number of detached threads, consuming system resources such as...